# AWS IAM Published articles for AWS IAM. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Operationalizing least privilege: Automate IAM remediation through your CI/CD pipeline DevFeed: [Operationalizing least privilege: Automate IAM remediation through your CI/CD pipeline]() Original publisher: [Read original article]() Author: Luis Pastor Published: 2026-09-15T15:53:51Z Content type: tutorial Language: en Sources: [AWS Security Blog]() Topics: [AWS Identity and Access Management (IAM)](), [CI/CD](), [Infrastructure as code](), [AWS CloudFormation](), [Amazon Web Services]() Tags: [aws](), [aws-cloudformation](), [aws-cloudtrail](), [aws-iam](), [aws-identity-and-access-management-iam](), [aws-organizations](), [best-practices](), [ci-cd](), [expert-400](), [iam](), [infrastructure-as-code-iac](), [least-privilege](), [pull-request](), [security](), [security-blog](), [security-identity-compliance](), [technical-how-to]() ### AI overview This article describes an automated workflow for operationalizing least privilege in AWS. It explains how AWS IAM Access Analyzer identifies unused permissions and how remediation can be routed through different paths for infrastructure-as-code-managed, manually created, and unused IAM principals. ### Source excerpt The principle of least privilege is straightforward to articulate but challenging to maintain at scale. When teams first deploy applications to AWS, they often grant broader permissions than strictly necessary; it's faster to get things working, and the plan is always to tighten permissions later. But later rarely comes. Permissions accumulate, AWS Identity and Access [...] ## Password spraying campaign targets AWS root user accounts across 150+ organizations DevFeed: [Password spraying campaign targets AWS root user accounts across 150+ organizations]() Original publisher: [Read original article]() Author: Martin McCloskey Published: 2026-08-31T00:00:00Z Content type: article Language: en Sources: [Datadog Security Labs]() Topics: [Amazon Web Services](), [Security](), [Threat Research](), [AWS IAM](), [IAM](), [Authentication](), [passwords]() Tags: [authentication](), [aws](), [aws-iam](), [iam](), [identity](), [password-spraying](), [research](), [security]() ### AI overview Datadog Security Research describes a password spraying campaign that repeatedly targeted AWS root user accounts at more than 150 organizations between July 24 and August 23, 2026. The campaign used Chrome and Firefox user-agent fingerprints and proxy infrastructure; no successful authentications were observed, and the attackers' motive remains undetermined. The article explains the privileges and safeguards associated with AWS root users and recommends reducing reliance on persistent root credentials. ### Source excerpt Datadog Security Research observed a password spraying campaign attempting to authenticate as the AWS root user across more than 150 organizations. ## Break-glass access for Amazon EKS when federated identity fails DevFeed: [Break-glass access for Amazon EKS when federated identity fails]() Original publisher: [Read original article]() Author: Sam Mukherjee Published: 2026-08-26T16:20:28Z Content type: article Language: en Sources: [Containers]() Topics: [Amazon EKS](), [AWS Identity and Access Management (IAM)](), [Infrastructure as code](), [MFA](), [Authorization](), [iac-security](), [migration]() Tags: [advanced-300](), [amazon-eks](), [amazon-elastic-kubernetes-service](), [aws-iam](), [best-practices](), [identity-and-access-management](), [infrastructure-as-code](), [mfa](), [migration](), [technical-how-to]() ### AI overview This post presents a break-glass access pattern for Amazon EKS clusters when a federated identity provider fails. It describes a dedicated cross-account IAM role with enforced, recency-aware MFA, infrastructure-as-code templates, validation tests, and post-incident recovery procedures. ### Source excerpt Implementing break-glass access for Amazon EKS clusters removes the circular dependency where a federated identity provider outage locks you out of the clusters you need to reach to fix it. This post supplies a cross-account IAM role with enforced MFA, infrastructure-as-code templates, validation tests, and a post-incident recovery procedure. ## Integrate your Spring Boot application with Amazon ElastiCache using Spring Data Valkey DevFeed: [Integrate your Spring Boot application with Amazon ElastiCache using Spring Data Valkey]() Original publisher: [Read original article]() Author: Chris Gillespie Published: 2026-08-18T16:38:30Z Content type: tutorial Language: en Sources: [AWS Database Blog]() Topics: [App](), [AWS IAM](), [telemetry]() Tags: [amazon-elasticache](), [applications](), [aws-iam](), [cache](), [cli](), [encryption](), [how-to](), [integration](), [intermediate-200](), [observability](), [opentelemetry](), [performance](), [redis](), [serverless](), [spring-boot](), [technical-how-to]() ### AI overview A tutorial for adding Amazon ElastiCache caching to a Spring Boot application with Spring Data Valkey. It covers dependencies, Valkey configuration, TTL settings, encryption, and migration compatibility with Spring Data Redis. ### Source excerpt Learn how to integrate a Spring Boot application with Amazon ElastiCache using Spring Data Valkey for caching. This walkthrough covers adding caching to a serverless cache, plus the advantages of Spring Data Valkey over Spring Data Redis: native AWS IAM authentication, Availability Zone affinity, and OpenTelemetry observability. ## Updates to your AWS Sign-In experience DevFeed: [Updates to your AWS Sign-In experience]() Original publisher: [Read original article]() Author: Vaibhav Chowla Published: 2026-08-17T17:22:33Z Content type: release Language: en Sources: [AWS Security Blog]() Topics: [Amazon Web Services (AWS)](), [AWS IAM](), [identity and access management](), [AWS IAM Identity Center](), [browser]() Tags: [amazon-web-services-aws](), [aws](), [aws-iam](), [aws-iam-identity-center](), [aws-identity-and-access-management-iam](), [browser](), [identity-and-access-management](), [intermediate-200](), [scripted](), [security-blog](), [security-identity-compliance](), [uncategorized](), [updates]() ### AI overview AWS is gradually introducing a redesigned sign-in and sign-up experience to a limited number of customers. The changes add new account access options, unify the initial email entry point, and refresh the session selection page while existing customers continue using their current credentials and sign-in methods. ### Source excerpt Amazon Web Services (AWS) is gradually introducing updates to the AWS Sign-In and sign-up experience to a limited number of customers. We're sharing these changes so you will know what to expect as we gradually make the updated experience available to more customers. These updates include new options for creating and accessing AWS accounts. To [...] ## How AWS IAM role manager rethinks the starting point for IAM roles DevFeed: [How AWS IAM role manager rethinks the starting point for IAM roles]() Original publisher: [Read original article]() Author: Zach Jiang Published: 2026-08-12T22:16:55Z Content type: article Language: en Sources: [AWS Security Blog]() Topics: [AWS IAM]() Tags: [aws](), [aws-iam](), [aws-identity-and-access-management-iam](), [aws-lambda](), [iam](), [intermediate-200](), [security-blog](), [security-identity-compliance](), [technical-how-to]() ### AI overview AWS IAM role manager automates creation and attachment of IAM roles for supported AWS service-console workflows, letting developers begin with default roles and refine permissions later. ### Source excerpt When you build a new application or capability on Amazon Web Services (AWS), you want to focus on what you're building. Getting a service running almost always begins with AWS Identity and Access Management (IAM). Many AWS services that act on your behalf need an IAM role, an identity the service assumes to access your [...] ## Pathfinding Labs: Deploy, test, and learn from 100+ intentionally vulnerable AWS environments DevFeed: [Pathfinding Labs: Deploy, test, and learn from 100+ intentionally vulnerable AWS environments]() Original publisher: [Read original article]() Author: Seth Art Published: 2026-05-18T00:00:00Z Content type: article Language: en Sources: [Datadog Security Labs]() Topics: [Amazon Web Services](), [AWS IAM](), [Terraform](), [Go Language](), [Command-line interface](), [Text-based user interface](), [ctf](), [Detection engineering](), [Security & compliance, Cloud security](), [Authorization]() Tags: [aws](), [aws-iam](), [cli](), [cloud](), [cloud-security](), [ctf](), [go](), [iam](), [sandbox](), [security](), [techniques](), [terraform](), [tool](), [tools](), [validation]() ### AI overview Pathfinding Labs is a collection of more than 100 intentionally vulnerable AWS environments for practicing and validating detection of IAM privilege-escalation and other cloud security misconfigurations. The project includes a web catalog with CTF-style hints and solutions, Terraform-based labs, and plabs, a Go CLI with an interactive terminal interface for deploying and exploiting the labs. ### Source excerpt Introducing Pathfinding Labs, a collection of intentionally vulnerable AWS environments for red teamers and blue teamers to deploy, exploit, and use for detection validation. ## CockroachDB Plans Native X.509 SAN Support for SPIFFE and SPIRE Integration DevFeed: [CockroachDB Plans Native X.509 SAN Support for SPIFFE and SPIRE Integration]() Original publisher: [Read original article]() Author: Sanchit Khanna,Biplav Saraf Published: 2026-03-13T00:00:00Z Content type: article Language: en Sources: [Cockroach Labs]() Topics: [CockroachDB](), [Databases](), [SPIFFE](), [SPIRE](), [certificates](), [Zero Trust](), [Security](), [Microservice]() Tags: [architectures](), [auditability](), [aws-iam](), [certificates](), [cockroachdb](), [compliance](), [cryptographic](), [database](), [distributed](), [processor](), [regex](), [security](), [soc](), [soc-2](), [spiffe](), [spire](), [standards](), [teams](), [verification](), [zero-trust]() ### AI overview The article previews planned CockroachDB authentication support for Subject Alternative Name fields in X.509 certificates. It explains how SAN support is intended to enable integration with SPIFFE and SPIRE and support regex-based identity mapping for cloud-native workloads. ### Source excerpt In the evolution of cloud-native security, identity has become the new perimeter. ## OIDC workload identity on AWS DevFeed: [OIDC workload identity on AWS]() Original publisher: [Read original article]() Published: 2025-11-04T15:00:00Z Content type: tutorial Language: en Sources: [Latacora]() Topics: [OpenID connect (OIDC)](), [Amazon Web Services](), [AWS IAM](), [Open Source](), [Cloud](), [implementation](), [Amazon EC2]() Tags: [api](), [authentication](), [aws](), [aws-iam](), [identity](), [oidc](), [open-source](), [vpc]() ### AI overview This article explains workload identity on AWS and presents aws-oidc-token-exchange, an open-source bridge that allows AWS workloads to authenticate to OIDC-based services using existing IAM identities. It describes short-lived, platform-issued identity tokens as an alternative to managing API keys, passwords, and certificates. ### Source excerpt Update: after years of being on the wish list of a ton of top AWS teams, AWS released a built-in version of this feature about two weeks after we published this. Never let it be said gentle ribbing doesn't work. Also, thanks AWS! We meant it when we said that the only thing better than having something easy to deploy was not needing to deploy anything at all. Everything in this post about workload identity is still relevant but you should probably use upstream's implementation unless you have a good reason not to (for example, private validators for whom you need a VPC endpoint). ## 4 Ways to Secure Bedrock Agent-Initiated Actions with Teleport DevFeed: [4 Ways to Secure Bedrock Agent-Initiated Actions with Teleport]() Original publisher: [Read original article]() Author: jackson.pitts@goteleport.com (Jack Pitts) Published: 2025-09-12T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Amazon Bedrock](), [AI Agent](), [Model Context Protocol](), [Security](), [AWS IAM](), [Cloud]() Tags: [ai-agent](), [amazon-bedrock](), [automation](), [aws-iam](), [model-context-protocol](), [security](), [sensitive-data]() ### AI overview This tutorial explains how to secure AI agent-initiated actions involving Amazon Bedrock and the Model Context Protocol. It describes using unique identities, AWS IAM roles, x.509 certificates, policy checks, short-lived session certificates, and audit logging through Teleport. ### Source excerpt Bedrock AI agents can accelerate cloud operations but require guardrails. Learn four ways to secure Bedrock agent-initiated actions with Teleport. ## 5 Ways to Keep AWS Fast with Just-in-Time Access DevFeed: [5 Ways to Keep AWS Fast with Just-in-Time Access]() Original publisher: [Read original article]() Author: jpitts@goteleport.com (Jack Pitts) Published: 2025-08-27T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [Amazon Web Services](), [JIT](), [Amazon Elastic Kubernetes Service](), [AWS IAM](), [audit trail](), [Security](), [Amazon EC2](), [AI Agent](), [Amazon Bedrock](), [CI/CD](), [Amazon DocumentDB](), [PostgreSQL]() Tags: [ai-agent](), [amazon-bedrock](), [amazon-rds](), [audit-trail](), [aws](), [aws-iam](), [ci-cd](), [jit](), [least-privilege](), [postgresql](), [security]() ### AI overview This article explains how Teleport's just-in-time access model can help govern fast-moving AWS environments. It describes ephemeral, policy-defined privileges for humans, machines, and AI agents, with least-privilege controls, approvals, expirations, and audit visibility across use cases including EKS, EC2, AWS Console, CI/CD, and AI access. ### Source excerpt Learn how just-in-time access accelerates EKS, EC2, AWS Console, CI/CD, and AI access while eliminating standing privileges and ensuring full audit visibility. ## How to use Teleport Machine ID to provide database access to applications running on EKS without passwords DevFeed: [How to use Teleport Machine ID to provide database access to applications running on EKS without passwords]() Original publisher: [Read original article]() Author: info@goteleport.com (Gavin Frazar) Published: 2024-12-03T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Amazon EKS](), [Kubernetes](), [PostgreSQL](), [Authorization](), [AWS Fargate](), [certificates](), [Access Control](), [Amazon Elastic Container Service](), [TLS (Transport Layer Security)](), [AWS IAM](), [container](), [VPC]() Tags: [access-control](), [api-keys](), [aws-fargate](), [aws-iam](), [certificates](), [container](), [ecs](), [how-to](), [kubernetes](), [passwords](), [postgresql](), [secrets](), [tls](), [vpc]() ### AI overview A tutorial on deploying Temporal on Amazon EKS so it can connect to an AWS RDS PostgreSQL database without passwords or other shared secrets. It uses Teleport Machine & Workload Identity, a sidecar, short-lived X.509 certificates, PostgreSQL role provisioning, and a Teleport Database Service deployed on AWS Fargate. ### Source excerpt Discover how to secure database access in Kubernetes workloads. Eliminate secrets, keep databases in private networks, and improve audit logging with Teleport. ## Secure Workload Identity with SPIRE and OIDC: A Guide for Kubernetes and Istio Users DevFeed: [Secure Workload Identity with SPIRE and OIDC: A Guide for Kubernetes and Istio Users]() Original publisher: [Read original article]() Author: Nikhil Arora Published: 2024-07-03T15:52:26Z Content type: tutorial Language: en Sources: [Indeed]() Topics: [SPIRE](), [istio](), [Kubernetes](), [OpenID connect (OIDC)](), [Zero Trust](), [AWS Identity and Access Management (IAM)](), [Architecture & Design]() Tags: [authentication](), [authorization](), [aws-iam](), [credentials](), [guide](), [identity](), [istio](), [kubernetes](), [oidc](), [secrets](), [spire](), [unsorted](), [zero-trust]() ### AI overview This guide describes Indeed's approach to building a workload identity platform for Kubernetes and Istio using SPIRE and OIDC, with identities and access controls rooted in Zero Trust principles. It discusses credential risks, design choices, and implementation challenges for heterogeneous first-party and third-party workloads. ### Source excerpt Goal This blog is for engineering teams, architects, and leaders responsible for defining and implementing a workload identity platform and access controls rooted in Zero Trust principles to mitigate the risks from compromised services. It is relevant for companies using Kubernetes to manage workloads, using Istio for service mesh, and aiming to define identities in [...] ## AWS without Access Keys DevFeed: [AWS without Access Keys]() Original publisher: [Read original article]() Published: 2024-06-19T00:00:00Z Content type: tutorial Language: en Sources: [The Fly Blog]() Topics: [AWS IAM](), [Amazon S3]() Tags: [aws](), [aws-iam](), [cdn](), [close-to-users](), [cloud-security](), [deploy-app-servers](), [docker](), [elixir](), [fly](), [fly-io](), [heroku-alternative](), [heroku-competitor](), [hosting](), [i](), [identity](), [networking](), [postgresql-clusters](), [s3](), [secrets](), [servers]() ### AI overview A tutorial on using OIDC to establish limited trust between Fly.io and AWS IAM, allowing Fly Machines to access an S3 bucket without distributing AWS access keys. ### Source excerpt It's dangerous to go alone. Fly.io runs full-stack apps by transmuting Docker containers into Fly Machines: ultra-lightweight hardware-backed VMs. You can run all your dependencies on Fly.io, but sometimes, you'll need to work with other clouds, and we've made that pretty simple. Try Fly.io out for yourself; your Rails or Node app can be up and running in just minutes. Let's hypopulate you an app serving generative AI cat images based on the weather forecast, running on a g4dn.xlarge ECS task in AWS us-east-1. It's going great; people didn't realize how dependent their cat pic prefs are on barometric pressure, and you're all anyone can talk about. Word reaches Australia and Europe, but you're not catching on, because the... latency is too high? Just roll with us here. Anyways: fixing this is going to require replicating ECS tasks and ECR images into ap-southeast-2 and eu-central-1 while also setting up load balancing. Nah. This is the O.G. Fly.io deployment story; one deployed app, one versioned container, one command to get it running anywhere in the world. But you have a problem: your app relies on training data, it's huge, your giant employer manages it, and it's in S3. Getting this to work will require AWS credentials. You could ask your security team to create a user, give it permissions, and hand over the AWS keypair. Then you could wash your neck and wait for the blade. Passing around AWS keypairs is the beginning of every horror story told about cloud security, and security team ain't having it. There's a better way. It's drastically more secure, so your security people will at least hear you out. It's also so much easier on Fly.io that you might never bother creating a IAM service account again. Let's Get It out of the Way We're going to use OIDC to set up strictly limited trust between AWS and Fly.io. In AWS: we'll add Fly.io as an Identity Provider in AWS IAM, giving us an ID we can plug into any IAM Role. Also in AWS: we'll create a Role, give it access to ## Security in AWS: IAM Best Practices and Advanced Techniques DevFeed: [Security in AWS: IAM Best Practices and Advanced Techniques]() Original publisher: [Read original article]() Author: Guillermo Ojeda Published: 2024-03-20T00:41:01Z Content type: tutorial Language: en Sources: [Guille Ojeda]() Topics: [AWS Identity and Access Management (IAM)](), [IAM](), [Security](), [Access Control](), [Authorization](), [Infrastructure as code]() Tags: [access-control](), [aws](), [aws-iam](), [best-practices](), [cloud](), [iam](), [infrastructure-as-code](), [json](), [security](), [techniques]() ### AI overview A tutorial on AWS IAM fundamentals, best practices, and advanced techniques. It covers users, groups, roles, IAM policies, granular access control, cross-account access, and automating IAM with Infrastructure as Code. ### Source excerpt AWS IAM (Identity and Access Management) is the backbone of any AWS security strategy. It's the service that controls who can access your AWS resources and what actions they can perform. Get IAM right, and you're well on your way to a secure cloud de... ## Connect Using EC2 Instance Connect via Teleport DevFeed: [Connect Using EC2 Instance Connect via Teleport]() Original publisher: [Read original article]() Author: info@goteleport.com (Marco Dinis) Published: 2023-12-06T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Amazon EC2](), [ssh](), [AWS IAM](), [WebSocket]() Tags: [amazon-ec2](), [aws](), [aws-iam](), [public-key](), [ssh](), [tcp](), [websocket]() ### AI overview This post explains how Teleport integrates with Amazon EC2 Instance Connect Endpoint to provide agentless SSH access to public or private Linux EC2 instances, including instances without public IP addresses. It describes IAM-controlled access, temporary SSH public keys, WebSocket tunneling, and SSH authentication. ### Source excerpt This post describes a new Teleport feature that enables SSH access using the EC2 Instance Connect Endpoint. ## Detecting Failed Sign In Attempts to AWS and Alerting DevFeed: [Detecting Failed Sign In Attempts to AWS and Alerting]() Original publisher: [Read original article]() Author: Guillermo Ojeda Published: 2023-10-26T15:26:47Z Content type: tutorial Language: en Sources: [Guille Ojeda]() Topics: [AWS CloudTrail](), [AWS IAM](), [MFA](), [Amazon Web Services](), [Security](), [cloud security]() Tags: [aws](), [aws-cloudtrail](), [aws-iam](), [best-practices](), [mfa](), [password](), [phishing](), [security]() ### AI overview A tutorial describes detecting failed AWS sign-in attempts caused by failed MFA checks and using AWS CloudTrail event logs to investigate authentication activity. It explains that CloudTrail records requests from the AWS Console, CLI, SDKs, and APIs, and that trails can export events to Amazon S3 or CloudWatch Logs for analysis. ### Source excerpt Note: This content was originally published at the Simple AWS newsletter. Imagine this scenario: You're careful with security, and you set up Multi-Factor Authentication for your AWS IAM or IAM Identity Center user. At one point, a malicious agent of... ## AWS IAM and Cost Explorer CLI Setup DevFeed: [AWS IAM and Cost Explorer CLI Setup]() Original publisher: [Read original article]() Published: 2023-02-01T16:15:02Z Content type: tutorial Language: en Sources: [Signs of Triviality]() Topics: [AWS IAM](), [Command-line interface](), [IAM](), [Amazon Web Services](), [account]() Tags: [account](), [admin](), [aws](), [aws-iam](), [cli](), [command](), [command-line](), [how-to](), [iam](), [setup]() ### AI overview A tutorial on creating an IAM administrator user and configuring another AWS account to use Cost Explorer from the command line. ### Source excerpt How to create an IAM admin user and configure another account to use Cost Explorer on the command-line. ## Automating Multi-Account Permission Management with AWS IAM Identity Center (previously AWS SSO) DevFeed: [Automating Multi-Account Permission Management with AWS IAM Identity Center (previously AWS SSO)]() Original publisher: [Read original article]() Author: Niko Jernejsek Published: 2022-12-22T10:32:09Z Content type: article Language: en Sources: [Homegate Engineering Blog - Medium]() Topics: [AWS IAM Identity Center](), [AWS Organizations](), [Single sign-on (SSO)](), [Authorization](), [IAM](), [CI/CD]() Tags: [aws](), [aws-eventbridge](), [aws-iam](), [aws-iam-identity-center](), [aws-organizations](), [cicd](), [cloudformation](), [iam-identity-center](), [least-privilege](), [saml](), [security](), [sso]() ### AI overview This article describes Homegate's multi-account AWS strategy and its use of AWS IAM Identity Center, formerly AWS SSO, to centrally manage permissions for engineers across AWS accounts. It explains the use of permission matrices, least-privilege access, AWS Organizations, external identity providers through SAML 2.0, and SCIM. ### Source excerpt Background Homegate was founded in 2001 and is now the leading property marketplace in Switzerland. Few years ago we decided to re-architect our monolithic real estate platform towards micro services on top of AWS cloud. At the moment, Homegate workloads are running almost exclusively on server-less compute model with teams organised around micro services. We are utilising so called multi-account strategy where we structure our AWS accounts around individual micro services further breaking them down into different accounts according to software lifecycle, and organising them into the AWS Organizational Units. We've structured our AWS Organizations Units & AWS accounts according to the recommendations provided by AWS (https://docs.aws.amazon.com/whitepapers/latest/organizing-your-aws-environment/basic-organization.html#basic-organization-with-cicd-as-a-separate-function). Apart from having product workload accounts we also have accounts which are necessary to operate security, governance and platform related workloads. Access to accounts is governed by a permission matrix which is based on least privilege principles. The permission matrix classifies who (internally defined personas, e.g.: engineers/managers/security officers, etc) has what type of access (e.g. read-only or admin), and to what category of AWS accounts (e.g. production workloads, shared infra accounts, etc). Group of accounts in our Permission Matrix are at the same time AWS Organisational Units that we implement. As we have to manage permissions for hundreds of engineers to about hundred of AWS accounts accordingly, this way of grouping makes it easier for us to manage it at scale. IAM Identity Center PrimerIAM Identity Center Intro Note that I will be using AWS IAM Identity Center and AWS SSO interchangeably as even some services (such as CloudFormation) are still using the previous name AWS SSO. AWS IAM Identity Center is a single sign-on (SSO) service that allows AWS users to centrally manage acces ## How to access AWS Console using AWS IAM DevFeed: [How to access AWS Console using AWS IAM]() Original publisher: [Read original article]() Author: info@goteleport.com (Marco Campana) Published: 2022-05-20T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [AWS IAM](), [AWS Management Console](), [Authentication](), [Authorization](), [audit](), [Single sign-on (SSO)](), [cloud-infrastructure]() Tags: [audit](), [authentication](), [authorization](), [aws](), [aws-iam](), [aws-management-console](), [cloud](), [cloud-infrastructure](), [console](), [how-to](), [identity](), [infrastructure](), [management](), [security](), [sso]() ### AI overview This tutorial explains traditional ways to access the AWS Management Console using AWS IAM, including the AWS User Portal, 2FA, IAM roles and users, the AWS CLI, access keys, and AWS SSO. It compares these native approaches with Teleport's features for securing and auditing AWS infrastructure access. ### Source excerpt Explore traditional AWS authentication processes to AWS Management Console and how Teleport can replace them to further secure and audit your cloud infrastructure. ## Teleport 9 - How We Built Machine ID DevFeed: [Teleport 9 - How We Built Machine ID]() Original publisher: [Read original article]() Author: sakshyam.shah@goteleport.com (Sakshyam Shah) Published: 2022-04-08T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [Automation](), [certificates](), [Authentication](), [AWS IAM](), [Security](), [ssh](), [Kubernetes]() Tags: [authentication](), [automation](), [aws-iam](), [certificates](), [kubernetes](), [product](), [security](), [ssh]() ### AI overview This post explains how Teleport built Machine ID to automate the issuance and renewal of short-lived certificates for machine-to-machine infrastructure access. It describes authentication through AWS IAM joining or one-time join tokens and the use of a lightweight renewal agent. ### Source excerpt This post explains how we built Machine ID, our latest product which automates short-lived certificate issuance and renewal for machine-to-machine access at scale. ## AWS IAM Access for multiple AWS accounts and products DevFeed: [AWS IAM Access for multiple AWS accounts and products]() Original publisher: [Read original article]() Author: info@goteleport.com (Kai Davenport) Published: 2022-01-26T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [AWS Identity and Access Management (IAM)](), [Amazon Web Services](), [Amazon EC2](), [Amazon S3]() Tags: [aws](), [aws-iam](), [backups](), [console](), [database](), [engineering](), [iam](), [monitoring](), [mysql](), [postgres](), [products](), [teams]() ### AI overview This article describes how Teleport enables AWS IAM access across multiple AWS accounts and products as engineering teams scale. It illustrates the operational risks of broad or difficult-to-standardize access, including accidental deletion of RDS instances, and notes that backups enabled restoration within an hour. ### Source excerpt This article describes how Teleport enables AWS IAM Access Across Multiple AWS Accounts and Products so engineering teams stay productive while their business scales. ## RBAC and ABAC with AWS IAM DevFeed: [RBAC and ABAC with AWS IAM]() Original publisher: [Read original article]() Author: info@goteleport.com (Shuo Yang) Published: 2021-07-12T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [AWS Identity and Access Management (IAM)](), [Access Control](), [IAM](), [Authorization]() Tags: [access-control](), [authorization](), [aws-iam](), [iam](), [identity](), [security]() ### AI overview This article explains role-based access control (RBAC) and attribute-based access control (ABAC) in AWS IAM. It describes how roles and groups can define privileges and how ABAC uses user, resource, and environment attributes to provide more fine-grained access control. ### Source excerpt When talking about application authorizations, we often encounter two concepts RBAC (role-based access control) and ABAC (attribute-based access control). ## How AWS IAM role, STS and Identity Pool work together DevFeed: [How AWS IAM role, STS and Identity Pool work together]() Original publisher: [Read original article]() Author: info@goteleport.com (Shuo Yang) Published: 2021-06-23T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [AWS IAM](), [AWS STS](), [Amazon Cognito](), [AWS Identity and Access Management (IAM)](), [Authentication](), [Authorization](), [Application Development](), [OpenID connect (OIDC)](), [Security]() Tags: [amazon-cognito](), [application-development](), [authentication](), [authorization](), [aws](), [aws-iam](), [aws-sts](), [cloud](), [oidc](), [security](), [services]() ### AI overview This tutorial explains how AWS IAM roles, AWS STS, and Amazon Cognito Identity Pools work together to let applications obtain temporary AWS credentials. It describes the flow from an OIDC token issued by a Cognito User Pool to temporary credentials obtained through STS and subsequent access to AWS resources. ### Source excerpt Learn how to access AWS resources using Cognito Identity Pool in combination with AWS STS to provide temporary credentials without long-lived keys. [Next page]()