|
Immediately, we’re saying the final availability of AWS IAM Id Heart multi-Area help to allow AWS account entry and managed utility use in extra AWS Areas.
With this characteristic, you may replicate your workforce identities, permission units, and different metadata in your group occasion of IAM Id Heart related to an exterior identification supplier (IdP), comparable to Microsoft Entra ID and Okta, from its present major Area to extra Areas for improved resiliency of AWS account entry.
It’s also possible to deploy AWS managed functions in your most well-liked Areas, near utility customers and datasets for improved person expertise or to fulfill knowledge residency necessities. Your functions deployed in extra Areas entry replicated workforce identities domestically for optimum efficiency and reliability.
Once you replicate your workforce identities to an extra Area, your workforce will get an lively AWS entry portal endpoint in that Area. Which means within the unlikely occasion of an IAM Id Heart service disruption in its major Area, your workforce can nonetheless entry their AWS accounts by the AWS entry portal in an extra Area utilizing already provisioned permissions. You’ll be able to proceed to handle IAM Id Heart configurations from the first Area, sustaining centralized management.
Allow IAM Id Heart in a number of Areas
To get began, you must verify that the AWS managed functions you’re presently utilizing help buyer managed AWS Key Administration Service (AWS KMS) key enabled in AWS Id Heart. After we launched this characteristic in October 2025, Seb really helpful utilizing multi-Area AWS KMS keys until your organization insurance policies limit you to single-Area keys. Multi-Area keys present constant key materials throughout Areas whereas sustaining unbiased key infrastructure in every Area.
Earlier than replicating IAM Id Heart to an extra Area, you should first replicate the shopper managed AWS KMS key to that Area and configure the duplicate key with the permissions required for IAM Id Heart operations. For directions on creating multi-Area duplicate keys, check with Create multi-Area duplicate keys within the AWS KMS Developer Information.
Go to the IAM Id Heart console within the major Area, for instance, US East (N. Virginia), select Settings within the left-navigation pane, and choose the Administration tab. Affirm that your configured encryption secret’s a multi-Area buyer managed AWS KMS key. So as to add extra Areas, select Add Area.
You’ll be able to select extra Areas to copy the IAM Id Heart in an inventory of the out there Areas. When selecting an extra Area, take into account your supposed use circumstances, for instance, knowledge compliance or person expertise.
If you wish to run AWS managed functions that entry datasets restricted to a particular Area for compliance causes, select the Area the place the datasets reside. When you plan to make use of the extra Area to deploy AWS functions, confirm that the required functions help your chosen Area and deployment in extra Areas.
Select Add Area. This begins the preliminary replication whose length is dependent upon the dimensions of your Id Heart occasion.
After the replication is accomplished, your customers can entry their AWS accounts and functions on this new Area. Once you select View ACS URLs, you may view SAML data, comparable to an Assertion Shopper Service (ACS) URL, concerning the major and extra Areas.
How your workforce can use an extra Area
AWS Id Heart helps SAML single sign-on with exterior IdPs, comparable to Microsoft Entra ID and Okta. Upon authentication within the IdP, the person is redirected to the AWS entry portal. To allow the person to be redirected to the AWS entry portal within the newly added Area, you should add the extra Area’s ACS URL to the IdP configuration.
The next screenshots present you ways to do that within the Okta admin console:
Then, you may create a bookmark utility in your identification supplier for customers to find the extra Area. This bookmark app features like a browser bookmark and comprises solely the URL to the AWS entry portal within the extra Area.
It’s also possible to deploy AWS managed functions in extra Areas utilizing your current deployment workflows. Your customers can entry functions or accounts utilizing the prevailing entry strategies, such because the AWS entry portal, an utility hyperlink, or by the AWS Command Line Interface (AWS CLI).
To be taught extra about which AWS managed functions help deployment in extra Areas, go to the IAM Id Heart Person Information.
Issues to know
Listed here are key issues to learn about this characteristic:
- Consideration – To benefit from this characteristic at launch, you have to be utilizing a company occasion of IAM Id Heart related to an exterior IdP. Additionally, the first and extra Areas have to be enabled by default in an AWS account. Account cases of IAM Id Heart, and the opposite two identification sources (Microsoft Lively Listing and IAM Id Heart listing) are presently not supported.
- Operation – The first Area stays the central place for managing workforce identities, account entry permissions, exterior IdP, and different configurations. You should use the IAM Id Heart console in extra Areas with a restricted characteristic set. Most operations are read-only, apart from utility administration and person session revocation.
- Monitoring – All workforce actions are emitted in AWS CloudTrail within the Area the place the motion was carried out. This characteristic enhances account entry continuity. You’ll be able to arrange break-glass entry for privileged customers to entry AWS if the exterior IdP has a service disruption.
Now out there
AWS IAM Id Heart multi-Area help is now out there within the 17 enabled-by-default industrial AWS Areas. For Regional availability and a future roadmap, go to the AWS Capabilities by Area. You should use this characteristic at no extra price. Customary AWS KMS prices apply for storing and utilizing buyer managed keys.
Give it a attempt within the AWS Id Heart console. To be taught extra, go to the IAM Id Heart Person Information and ship suggestions to AWS re:Publish for Id Heart or by your traditional AWS Assist contacts.
— Channy