● Covered by 1 source · 1 reportMedium impact1 neutral
AWS IAM outbound identity federation now supports cross-partition role assumption
Key points
- IAM outbound federation now supports cross-partition role assumption.
- Workloads can use JWTs to authenticate across AWS partitions.
- Eliminates need for long-term credentials for cross-partition access.
- Destination trust policies can condition on source identity context.
Cross-Partition Access Enabled
AWS Identity and Access Management (IAM) outbound identity federation has been updated to allow workloads to assume roles in other AWS partitions. This means that applications running in one AWS partition, such as Commercial, can now access resources or communicate with AWS services located in another partition, like China or GovCloud (US).
Addressing Isolation Boundaries
Previously, AWS partitions functioned as hard isolation boundaries, each with independent IAM instances. This design meant that credentials issued in one partition were not valid in another, preventing direct role assumption across these boundaries and limiting resource policies from referencing principals in different partitions. The new functionality overcomes these limitations.
Mechanism for Federation
The updated mechanism allows a workload in one partition to obtain a short-lived, AWS signed JSON Web Token (JWT) using sts:GetWebIdentityToken. This JWT can then be exchanged for temporary credentials in a different partition using sts:AssumeRoleWithWebIdentity. This process removes the requirement to store or rotate long-term credentials for cross-partition access.
Benefits and Compliance
IAM outbound identity federation for cross-partition access offers benefits such as carrying origin identity into authorization decisions, allowing destination trust policies to condition on the source identity's context (e.g., AWS account, organization ID, source AWS Region, and principal). It also provides a cross-partition audit trail, with AWS CloudTrail events in the destination Region including the source principal ARN and token ID. Organizations are advised to consult their compliance teams to ensure alignment with regulatory obligations like FedRAMP, ITAR, DoD CC SRG, and GDPR when implementing cross-partition access.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
AWS Identity and Access Management (IAM) outbound identity federation now allows workloads to assume roles in different AWS partitions, including Commercial, China, and GovCloud (US). This update enables direct access to resources and services across these isolated boundaries, addressing previous limitations where credentials were not valid across partitions. Workloads can obtain a short-lived JSON Web Token (JWT) in one partition and exchange it for temporary credentials in another, removing the need for long-term credential storage.