# IAM Published articles for IAM. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Article: Identity as an Architectural Concern: Enterprise IAM Beyond Authentication DevFeed: [Article: Identity as an Architectural Concern: Enterprise IAM Beyond Authentication]() Original publisher: [Read original article]() Author: Vaishnavi Khosla Published: 2026-11-06T09:00:00Z Content type: article Language: en Sources: [InfoQ]() Topics: [identity and access management](), [Access Control](), [rbac](), [HashiCorp Vault](), [Secure token management](), [Single sign-on (SSO)](), [Publish-subscribe pattern]() Tags: [account](), [architecture](), [architecture-design](), [article](), [authentication](), [authorization](), [based](), [data](), [design](), [development](), [don-t](), [enterprise](), [event](), [experience](), [governance](), [graph](), [iam](), [identity](), [identity-as-architecture](), [identity-management](), [java](), [management](), [models](), [oauth](), [rbac](), [scope](), [security](), [service](), [single-sign-on](), [stream]() ### AI overview At enterprise scale, identity design shapes data models, service boundaries, ownership governance, and revocation behavior. The author describes modeling ownership and time-bounded access as relationships in Neo4j, queried through GraphQL; this made common ownership and validity questions direct, though it adds datastore and modeling costs, and the article says flat RBAC remains suitable for small, single-app setups. A unified workflow for attestation, credential rotation, and vaulting reduced reported revocation time from about three days to under one. Because the vault is owned by another team, the integration fails closed and reconciles its state before marking vaulting complete. Across services, scoped OAuth 2.0 token exchange carries identity context while a policy decision point makes authorization decisions. Kafka distributes entitlement changes, so revocation is eventually consistent: consumers invalidate cached decisions, and a maximum cache age bounds stale access if an event is lost, at the cost of more source-of-truth checks when that limit is shorter. ### Source excerpt The way you design your identities will drive your data models, your service scope, and your revocation policies; enterprise identity management is thus an architectural problem, not an afterthought. Based on our experience in service account governance, this article touches upon graph vs. RBAC, integrating a vault you don't own, and bounding revocation latency for an event stream. By Vaishnavi Khosla ## Introducing AWS account access manager: IAM role flexibility with centralized workforce access DevFeed: [Introducing AWS account access manager: IAM role flexibility with centralized workforce access]() Original publisher: [Read original article]() Author: Moumita Saha Published: 2026-11-05T19:21:56Z Content type: release Language: en Sources: [AWS Security Blog]() Topics: [AWS IAM](), [AWS IAM Identity Center](), [identity and access management](), [rbac](), [Amazon Web Services](), [Single sign-on (SSO)](), [okta](), [AWS CloudTrail](), [Duo](), [Entra ID]() Tags: [access-control](), [access-management](), [aws](), [aws-cli](), [aws-cloudformation](), [aws-cloudtrail](), [aws-command-line-interface-aws-cli](), [aws-iam](), [aws-iam-identity-center](), [aws-identity-and-access-management-iam](), [aws-key-management-service](), [aws-key-management-service-aws-kms](), [aws-management-console](), [aws-sdk](), [aws-tools-for-powershell](), [best-practices](), [beyondtrust](), [iam](), [iam-identity-center](), [intermediate-200](), [security-blog](), [security-identity-compliance](), [technical-how-to](), [workforce]() ### AI overview Account access manager lets an organization assign existing IAM roles in individual AWS accounts to IAM Identity Center users and groups through a centralized federation point, while retaining role-specific trust policies, tags, and paths and adding user-level audit context. Setup requires an organization instance of IAM Identity Center, eligible IAM roles with a trust policy allowing the service, and management-account enablement in the Identity Center primary Region. Administrators create per-user or per-group entitlements; each role assignment is created individually, and the console cannot discover roles, so administrators must know their names. Users can access assigned roles in the portal or obtain CLI credentials with `aws login` (AWS CLI v2.36.0 or newer); IAM Identity Center commands such as `aws sso configure` do not work for these assignments. Role sessions use the underlying role's configured maximum duration, up to 12 hours. The text says the service is available at no additional cost in Commercial Regions except opt-in Regions, and excludes GovCloud (US), China, and other non-commercial Regions. ### Source excerpt AWS Identity and Access Management (IAM) is introducing account access manager, a flexible new way to manage workforce access to your Amazon Web Services (AWS) accounts. This combines the IAM role flexibility your teams already rely on, delivered through the centralized federation of AWS IAM Identity Center, with user-level visibility built-in. Account access manager streamlines [...] ## Introducing identity and access management for Lambda Cloud DevFeed: [Introducing identity and access management for Lambda Cloud]() Original publisher: [Read original article]() Author: Lambda Published: 2026-11-04T19:45:57Z Content type: release Language: en Sources: [The Lambda deep learning blog]() Topics: [identity and access management](), [rbac](), [Access Control]() Tags: [access-control](), [access-management](), [account](), [admin](), [api](), [api-key](), [api-keys](), [audit](), [cloud](), [console](), [gpu](), [gpu-cloud](), [groups](), [iam](), [identity](), [identity-and-access-management](), [lambda](), [lambda-cloud](), [product-updates](), [rbac](), [role-based-access-control](), [roles](), [security](), [service-identities]() ### AI overview Lambda Cloud IAM adds role-based access for users and software, with fine-grained roles at account or workspace scope. Resource actions require both workspace membership and a role that permits the action. Groups can contain users and service identities and pass assigned roles to their members; an effective access view shows direct and inherited roles by workspace. For automation, the article recommends giving scripts their own service identity, granting only needed roles, setting API key expiration, and rotating between its two keys; personal keys remain active until deleted. Only account admins and IAM admins can manage IAM. Existing Admin and Member access maps to Account Admin and Account Member, and current keys are unchanged. Audit logs are retained for six months; accounts can have up to 100 groups and 50 service identities. IAM is free. ### Source excerpt Role-based access control for your GPU cloud: roles, groups, and service identities are now in the Lambda Cloud console. ## Google adds new $250,000 Cloud VRP reward for Root-in-Cloud bugs DevFeed: [Google adds new $250,000 Cloud VRP reward for Root-in-Cloud bugs]() Original publisher: [Read original article]() Author: Sergiu Gatlan Published: 2026-11-03T12:05:52Z Content type: news Language: en Sources: [BleepingComputer]() Topics: [Bug Bounty](), [Google Cloud Platform (GCP)]() Tags: [bug-bounty](), [bug-bounty-program](), [bugs](), [cloud](), [code-execution](), [complex](), [computer-help](), [computers](), [control](), [credentials](), [cross](), [customer-projects](), [google](), [iam](), [impact](), [infrastructure](), [interaction](), [isolation](), [linux](), [mac](), [malware](), [malware-removal](), [program](), [reward](), [root](), [security](), [spyware](), [support](), [tech-support](), [technical-support](), [virus](), [virus-removal](), [vrp](), [vulnerability](), [vulnerability-disclosure-program](), [windows]() ### AI overview Google's Cloud Vulnerability Reward Program now offers up to $250,000 for "Root-in-Cloud" flaws that give an attacker full administrative control over arbitrary Google Cloud organizations or projects. Eligibility requires no prior victim-project access or special setup; exploits cannot rely on compromised credentials, social engineering, or user interaction. Qualifying flaws include tenant-isolation bypasses and complex cross-service logic bugs. Reports showing remote code execution in Google's production infrastructure or root-in-prod will also be reviewed for eligibility. Researchers must use Google's designated service account to cryptographically prove unauthorized access and must stop probing production systems; escalation, credential acquisition, or lateral movement leads to disqualification. The text points to Google's rules page for endpoint specifications, JSON payloads, and CLI examples. ### Source excerpt Google has expanded its Cloud Vulnerability Reward Program (VRP) with a new top-tier reward for high-impact architectural security flaws. [...] ## IAMRAGBENCH: Benchmarking Authorization Expansions in LLM-Generated AWS IAM Policies under RAG Poisoning DevFeed: [IAMRAGBENCH: Benchmarking Authorization Expansions in LLM-Generated AWS IAM Policies under RAG Poisoning]() Original publisher: [Read original article]() Author: Hasan Kaplan, Indika Kumara, Willem-Jan van den Heuvel, Damian Andrew Tamburri Published: 2026-11-03T05:00:00Z Content type: article Language: en Sources: [arXiv: Cryptography and Security]() Topics: [AWS IAM](), [LLM security](), [Authorization](), [Retrieval Augmented Generation (RAG)](), [Access Control](), [Large Language Model](), [identity and access management]() Tags: [access-management](), [amazon](), [amazon-web-services](), [amazon-web-services-aws](), [architecture](), [attack](), [attacks](), [authorization](), [aws](), [aws-iam](), [aws-identity-and-access-management-iam](), [benchmark](), [benchmarking](), [bm25](), [context](), [cs-cr](), [iam](), [llm](), [policies](), [rag](), [rag-poisoning]() ### AI overview IAMRAGBENCH evaluates whether attacker-controlled RAG context can make LLM-generated AWS IAM policies exceed task authorization requirements. In 60 cases across scope, conditions, explicit denies, trust, permissions boundaries, and role delegation, included-context exposure yielded 46 goal-matched attacks among 292 trials (15.75%). BM25 retrieved the designated poison for all tasks at k=5 but yielded 7/294 attacks (2.38%). Framing the same weakening as a final architecture exception yielded 74/116 attacks in a two-endpoint stress test and 115/294 in a post hoc five-endpoint extension. In replay, AWS CheckNoNewAccess reported no new access for four of 168 goal-matched exact attacks; the benchmark's full pre-deployment rule rejected all 171 exact authorization deltas and sent five unresolved cases to review. The authors conclude that IAM copilots should be treated as proposal generators and their outputs independently checked before deployment. ### Source excerpt arXiv:2611.03431v1 Announce Type: new Abstract: Large language models (LLMs) using retrieval-augmented generation (RAG) can synthesize Amazon Web Services (AWS) Identity and Access Management (IAM) policies from tasks and operational documents. Attacker-controlled context may induce provider-valid policies that exceed trusted authorization requirements. We present IAMRAGBENCH, a 60-case benchmark spanning scope, conditions, explicit denies, trust, permissions boundaries, and role delegation. It combines deterministic authorization-envelope scoring with case-specific validation, including request-level checks where supported. An attack requires a provider-valid clean policy that satisfies the task and a provider-valid treatment policy that violates the envelope, matches a predeclared goal, preserves an intended request, and newly authorizes a forbidden request. Across five endpoints, included-context exposure produces 49 exact authorization deltas, including 46 goal-matched attacks (46/292; 15.75\%). End-to-end BM25 over 720 documents retrieves the designated poison for all 60 tasks at \(k=5\) but produces 7/294 goal-matched attacks (2.38\%). Presenting the same weakening as a final security architecture exception produces 74/116 attacks in a frozen two-endpoint stress test (63.79\%) and 115/294 in a post hoc all-five extension using the same frozen prompts (39.12\%). In a replay of 194 provider-valid treatment policies that violate task requirements, AWS \texttt{CheckNoNewAccess} reports no new access for four of 168 goal-matched exact attacks. The full pre-deployment rule rejects all 171 exact deltas and routes five unresolved cases to review. These findings support treating IAM copilots as untrusted proposal generators whose outputs require independent authorization checks before deployment. ## Keycloak's observability journey: a guide for project maintainers DevFeed: [Keycloak's observability journey: a guide for project maintainers]() Original publisher: [Read original article]() Author: OpenTelemetry Authors; Docs CC BY Published: 2026-11-02T15:39:10Z Content type: article Language: en Sources: [OpenTelemetry]() Topics: [OpenTelemetry](), [observability](), [Keycloak](), [Prometheus]() Tags: [access-management](), [cncf](), [guide](), [iam](), [identity-and-access-management](), [interviews](), [keycloak](), [maintainers](), [oauth](), [oauth-2-0](), [observability](), [oidc](), [open-source](), [openid-connect](), [opentelemetry](), [saml]() ### AI overview Keycloak's maintainers found that the OpenTelemetry Java agent enabled quick experimentation but added dozens of seconds to startup, so they moved to native Quarkus integration to preserve fast startup. Metrics gave immediate value; tracing helped locate database and LDAP bottlenecks, and exemplars linked metric spikes to representative traces for investigating high-percentile latency. OpenTelemetry support is on by default, but users must enable a component such as tracing to export data. The source also flags operational tradeoffs: unlike pull-based Prometheus, push-based telemetry over an open TCP socket lacks built-in backpressure and raises questions about signal origin and overload. Keycloak uses custom identity-provider attribute prefixes because conventions are not standardized, and its maintainers call for clearer guides and validation tools such as Weaver. ### Source excerpt As part of an ongoing series, the Developer Experience SIG interviews organizations about their real-world OpenTelemetry deployments to share practical lessons with the broader community. This post features Keycloak, a CNCF project, and looks at the journey from the perspective of project maintainers who add native OpenTelemetry support to the software they ship. If you have ever needed an Identity and Access Management (IAM) solution, there is a good chance Keycloak was on your radar: a widely used, community-driven open source IAM system that secures applications by authenticating both human and non-human users through industry-standard protocols such as OpenID Connect (OIDC), OAuth 2.0, and SAML. ## Google Introduces $250,000 Root-in-Cloud Bug Bounty Reward DevFeed: [Google Introduces $250,000 Root-in-Cloud Bug Bounty Reward]() Original publisher: [Read original article]() Author: Ionut Arghire Published: 2026-11-02T13:25:11Z Content type: news Language: en Sources: [SecurityWeek]() Topics: [Google Cloud Platform (GCP)](), [Security, Privacy and Abuse Prevention]() Tags: [agentic](), [agentic-systems](), [ai](), [attack-surface](), [bounty](), [bug](), [bug-bounty-program](), [cloud](), [cloud-security](), [code-execution](), [control](), [credentials](), [customer-projects](), [full](), [google](), [google-cloud](), [iam](), [impact](), [isolation](), [research](), [reward](), [root](), [vulnerabilities]() ### AI overview Google's Cloud Vulnerability Reward Program now offers up to $250,000 for research showing that a flaw could enable full administrative control of arbitrary Google Cloud organizations or projects. Eligible paths must not rely on existing project access, compromised credentials, or user interaction. Google will also evaluate Borg remote code execution or root-in-production findings, but researchers must stop probing immediately after achieving Borg execution; escalation, credential extraction, or lateral movement can disqualify them. Validation uses a designated service account to prove unauthorized access without testing against real customer projects. Google says its assessment considers the initial entry point, execution context, and attack surface. ### Source excerpt The top payout is for high-impact architectural research demonstrating full administrative control. The post Google Introduces $250,000 Root-in-Cloud Bug Bounty Reward appeared first on SecurityWeek. ## Using Claude on Amazon Bedrock with Claude Code and Cowork DevFeed: [Using Claude on Amazon Bedrock with Claude Code and Cowork]() Original publisher: [Read original article]() Author: Ritesh Patel Published: 2026-10-31T23:00:00Z Content type: tutorial Language: en Sources: [Nirmata]() Topics: [Amazon Bedrock](), [Claude Code](), [Amazon Web Services](), [Claude](), [Single sign-on (SSO)](), [sessions](), [AWS Organizations]() Tags: [access-control](), [ai](), [ai-agents](), [ai-gateway](), [ai-governance](), [amazon-bedrock](), [anthropic](), [api](), [api-key](), [auditing](), [authentication](), [aws](), [aws-cli](), [aws-marketplace](), [aws-organizations](), [aws-sdk](), [bearer-token](), [browser](), [budget](), [cache](), [claude-code](), [claude-cowork](), [iam](), [security]() ### AI overview Claude Code and Cowork can send model requests to Amazon Bedrock and bill them through AWS, but they use different setup and identity flows. Claude Code uses the AWS credential chain: enable Bedrock access, grant inference permissions, choose a region, and pin model IDs before rollout. Managed settings can restrict startup model checks with an allowlist on v2.1.287 or later; an allowlist alone does not enforce that restriction. Cowork is configured in Claude Desktop and deployed through MDM, with IAM Identity Center sign-in and a permission set; AWS setup runs once per organization. Cowork's in-app sign-in and named profiles provide per-user CloudTrail identity, while a shared bearer token does not. The excerpt also notes limits: Claude Code lacks WebSearch and /logout on Bedrock, uses the Invoke API rather than Converse, and gateways must preserve the eventstream response type. ### Source excerpt Set up Claude Code and Claude Cowork on Amazon Bedrock with AWS sign-in, pinned model IDs, a managed model allowlist and the IAM policy that each one needs. ## Passkeys Are Better Than Passwords. But They Are Not Enough. DevFeed: [Passkeys Are Better Than Passwords. But They Are Not Enough.]() Original publisher: [Read original article]() Author: Torsten George Published: 2026-10-30T14:00:00Z Content type: opinion Language: en Sources: [SecurityWeek]() Topics: [Passkeys](), [Zero Trust]() Tags: [artificial-intelligence](), [attack-surface](), [authentication](), [compromise](), [credential-stuffing](), [credential-theft](), [cryptography](), [cybersecurity](), [detection](), [iam](), [identity](), [identity-access](), [identity-security](), [identity-verification](), [passkey](), [passkeys](), [password](), [passwords]() ### AI overview Passkeys reduce phishing and credential theft by using a device-held private key that is not transmitted, but successful authentication alone does not establish lasting trust in an identity. The article highlights risks around account enrollment, recovery when users change devices, and activity after login, including session hijacking and anomalous transactions. It recommends pairing passkeys with identity threat detection that evaluates signals such as device characteristics, behavior, account changes, and transaction context over time. Risk-based controls can allow routine activity while escalating verification when risk changes. The text does not specify a particular product or implementation. ### Source excerpt As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it. The post Passkeys Are Better Than Passwords. But They Are Not Enough. appeared first on SecurityWeek. ## How resource tagging scopes the AWS Transform connector role DevFeed: [How resource tagging scopes the AWS Transform connector role]() Original publisher: [Read original article]() Author: Olufemi Alabi Published: 2026-10-28T17:28:55Z Content type: article Language: en Sources: [Migration & Modernization]() Topics: [AWS Transform](), [AWS IAM](), [Amazon Web Services](), [Amazon EC2]() Tags: [amazon-ec2](), [aws](), [aws-application-migration-service](), [aws-identity-and-access-management-iam](), [aws-organizations](), [aws-transform](), [ebs](), [error](), [how-to](), [iam](), [intermediate-200](), [migration](), [technical-how-to]() ### AI overview AWS Transform's connector role gates migration write actions on resource tags, so an AccessDenied during launch or cutover often means a required tag is missing or mismatched. The role expects `ATWorkspace` together with `CreatedFor` or `CreatedBy`; the article's example shows EC2 launch access conditioned on `CreatedFor: AWSTransform`, the matching workspace ID, and a call via MGN. Use the AWS Transform tagging page to apply the expected values, then check network resources, source server tags, and replication resources separately: source servers use `mgn:TagResource`, while EC2 replication resources use `ec2:CreateTags`. The person applying tags needs those permissions in their own role. A resource's `ATWorkspace` value is single-workspace and can be overwritten by another workspace, immediately affecting the first workspace's access. Test launches validate only the server's particular subnet and security group configuration; check each distinct pattern. A custom instance profile may also require a narrowly scoped `iam:PassRole` permission on its role ARN. ### Source excerpt AccessDenied during an AWS Transform migration is often a missing or incorrect tag. This post shows you how to diagnose and resolve it. ## What happens when the agent is long gone, but its access key lives on? DevFeed: [What happens when the agent is long gone, but its access key lives on?]() Original publisher: [Read original article]() Author: Zeen Rachidi Published: 2026-10-28T14:00:00Z Content type: article Language: en Sources: [The New Stack]() Topics: [Credential theft](), [least privilege]() Tags: [agent](), [ai](), [ai-agents](), [attack](), [audit-logs](), [aws](), [aws-iam](), [clickhouse](), [cloud](), [cloud-native](), [configuration](), [console](), [control](), [costs](), [created](), [credentials](), [custom](), [days](), [env-zero](), [iam](), [key](), [platform-engineering](), [post-contributed](), [report](), [security](), [sponsor-env-zero](), [sponsored-post-contributed]() ### AI overview AWS IAM user access keys remain valid until someone disables or deletes them, so credentials can outlive the agents and projects that created them. The article shows how to query CloudQuery credential reports for active keys at least 90 days old and unused for at least 90 days, in ClickHouse or PostgreSQL. This is a review list, not proof a key is unnecessary: correlate results with audit logs and an accountable owner; root keys require a separate audit. For new credentials, an env zero OPA policy can deny selected long-lived key resources in Terraform and OpenTofu plans, including replacements, but it does not cover console or external-script creation, hardcoded secrets, or the deployment identity; unsupported plan formats are denied. OIDC federation can provide temporary AWS session credentials, though the role persists. TTLs trigger teardown rather than guarantee expiry: revocation depends on successful destruction of Terraform-managed credentials, and TTLs can be extended or delayed. For other keys, verify dependencies, deactivate and observe through the workload's schedule, obtain owner sign-off, then delete under change control. Entra ID exposes credential metadata and owners ### Source excerpt Imagine: There's a line on the credential report that no one on the platform team can explain. An IAM user The post What happens when the agent is long gone, but its access key lives on? appeared first on The New Stack. ## Building Multi-Cloud Security Guardrails With Policy-as-Code, IAM, and Automated Remediation DevFeed: [Building Multi-Cloud Security Guardrails With Policy-as-Code, IAM, and Automated Remediation]() Original publisher: [Read original article]() Author: Malitha Thirumalai Published: 2026-10-26T21:13:07Z Content type: tutorial Language: en Sources: [HackerNoon]() Topics: [policy-as-code](), [CI/CD](), [Open Policy Agent](), [Security, Identity, & Compliance](), [Platform Engineering](), [GitHub](), [Serverless](), [Amazon VPC](), [azure functions](), [trivy](), [AWS IAM Identity Center](), [pulumi]() Tags: [2](), [automated](), [automated-remediation](), [aws](), [aws-security-guardrails](), [azure](), [building](), [cloud](), [cloud-iam-security](), [cloud-security](), [code](), [detection](), [devsecops](), [gcp](), [guardrails](), [iam](), [infrastructure-as-code-iac](), [infrastructure-drift-detection](), [least-privilege](), [multi-cloud-security](), [policy](), [policy-as-code](), [remediation](), [security](), [using](), [with]() ### AI overview The article recommends treating cloud security controls as enforceable guardrails across AWS, Azure, and GCP. It proposes blocking noncompliant infrastructure plans in CI with IaC scanners and OPA or Sentinel, with provider-specific storage policies; restricting production console writes and detecting drift through scheduled AWS plans, Azure Resource Graph or Automation, and GCP Asset Inventory or query tools; and using OIDC federation for short-lived credentials plus organization-level deny policies. It also advocates assessing chained attack paths, least-privilege identities, default-deny east-west traffic, and egress controls. For runtime drift, it outlines provider-native event-driven remediation and says fixes should update IaC through pull requests. The article cautions that direct automated changes can conflict with Terraform state, and recommends progressing carefully because deleting noncompliant production resources can disrupt services. ### Source excerpt Learn how to secure AWS, Azure, and GCP using policy-as-code, drift detection, least-privilege IAM, microsegmentation, and automated remediation. ## Enable cross-Region fine-grained data access with AWS Lake Formation and Trusted Identity Propagation DevFeed: [Enable cross-Region fine-grained data access with AWS Lake Formation and Trusted Identity Propagation]() Original publisher: [Read original article]() Author: Maneesh Sharma Published: 2026-10-23T19:50:12Z Content type: article Language: en Sources: [AWS Big Data Blog]() Topics: [AWS IAM Identity Center](), [AWS Lake Formation](), [Access Control](), [Authorization](), [identity and access management](), [AWS Glue](), [AWS IAM](), [Resource Access Manager (RAM)](), [AWS CloudTrail](), [Single sign-on (SSO)](), [data lake](), [AWS Organizations]() Tags: [access-control](), [advanced-300](), [amazon](), [amazon-redshift](), [amazon-s3](), [announcements](), [auditability](), [aws](), [aws-cloudtrail](), [aws-iam](), [aws-iam-identity-center](), [aws-lake-formation](), [cloudtrail](), [control](), [corporate](), [cross](), [data](), [fine](), [iam](), [identity](), [region](), [with]() ### AI overview AWS IAM Identity Center Trusted Identity Propagation (TIP) lets users query Lake Formation governed data across Regions as their own identities, with Lake Formation authorization and per-user AWS CloudTrail auditability. The producer and consumer accounts must share an organization instance of IAM Identity Center, replicated to the Regions in use. For S3 data queried with Athena, share the Lake Formation catalog and table, accept the AWS RAM share, create a resource link in the consumer's query Region, and grant users Describe access to it; the data stays in the producer Region while the query runs elsewhere. For Redshift data, register a Redshift Serverless namespace in the producer's AWS Glue Data Catalog, share it through Lake Formation, and configure a consumer external schema that references that catalog; no resource link is needed. The engines differ in cross-Region constraints: Athena works across Regions without additional constraints, while a Redshift datashare requires the Redshift query engine to be in the namespace's Region. ### Source excerpt Trusted Identity Propagation with AWS IAM Identity Center now works across Regions. Learn how to share AWS Lake Formation-governed Amazon S3 and Amazon Redshift data in one Region and query it from another as the actual corporate user, with fine-grained access control and per-user auditability in AWS CloudTrail. ## Deploy Amazon WorkSpaces across Regions with Entra ID and IAM Identity Center DevFeed: [Deploy Amazon WorkSpaces across Regions with Entra ID and IAM Identity Center]() Original publisher: [Read original article]() Author: Haneesh Kotha Published: 2026-10-23T14:26:01Z Content type: tutorial Language: en Sources: [Desktop and Application Streaming]() Topics: [AWS IAM Identity Center](), [Amazon WorkSpaces](), [Entra ID](), [Single sign-on (SSO)]() Tags: [active-directory](), [amazon-workspaces](), [architecture](), [aws](), [aws-iam-identity-center](), [azure](), [best-practices](), [customer-solutions](), [deploy](), [entra-id](), [euc](), [iam](), [iam-identity-center](), [identity](), [identity-management](), [microsoft](), [microsoft-entra-id](), [organizations](), [personal](), [region](), [regions](), [runtime](), [workspaces]() ### AI overview IAM Identity Center multi-Region replication lets organizations connect one Microsoft Entra ID tenant to Amazon WorkSpaces Personal across Regions while each Region authenticates locally against its own replica. The setup synchronizes users and groups to a primary Identity Center instance, encrypts and replicates identity data with a customer-managed multi-Region KMS key, and configures Entra ID SAML/SCIM, Intune, and Windows Autopilot for Entra-joined desktops. Each Region also needs local Secrets Manager credentials and a WorkSpaces directory tied to its replica; directory names must match Autopilot OrderID rules exactly. Local authentication can continue during an outage in another Region, but identity-change propagation depends on the primary. The source also notes UPN length and change constraints, manual replication of KMS key policy updates, and the need to plan Entra client-secret rotation. ### Source excerpt Organizations with a globally distributed workforce often need to deploy Amazon WorkSpaces Personal across multiple AWS Regions while maintaining centralized identity management with Microsoft Entra ID (formerly Azure Active Directory). Until recently, this required a tradeoff: either a single AWS IAM Identity Center instance with cross-Region calls at runtime, or separate Identity Center instances per [...] ## Best practices for integrating IAM Roles Anywhere with your PKI DevFeed: [Best practices for integrating IAM Roles Anywhere with your PKI]() Original publisher: [Read original article]() Author: Abhishek Avinash Agawane Published: 2026-10-21T17:03:50Z Content type: article Language: en Sources: [AWS Security Blog]() Topics: [AWS IAM](), [Amazon Web Services](), [AWS Security Token Service](), [identity and access management](), [Secrets Management](), [Security](), [enterprise certificate authority certificates](), [Cryptography](), [principle of ephemerality]() Tags: [access-management](), [advanced-300](), [amazon](), [amazon-web-services](), [amazon-web-services-aws](), [aws](), [aws-certificate-manager](), [aws-iam](), [aws-identity-and-access-management-iam](), [best](), [best-practices](), [credentials](), [getting](), [iam](), [iam-roles](), [identity](), [identity-and-access](), [identity-and-access-management](), [pki](), [practices](), [roles](), [security-blog](), [security-identity-compliance](), [with]() ### AI overview IAM Roles Anywhere lets workloads outside AWS exchange CA-signed X.509 certificates for temporary IAM credentials. The article recommends distinct certificates and IAM roles per workload, trust policies that restrict access using certificate-derived subject, issuer or SAN attributes, and session policies to narrow permissions. Trust-anchor placement affects which certificates are accepted; short certificate validity limits exposure, while just-in-time issuance can apply role changes immediately but depends on CA support. Protect private keys with PKCS #11 stores or TPM 2.0 where available; macOS Keychain and Windows certificate stores are also supported. For credentials, SDKs refresh credential_process results in memory, but the AWS CLI invokes it on every command; `serve` avoids that repeated call, while `update` writes credentials to disk and carries file-access risk. The article also recommends expiry monitoring and blue/green trust-anchor rotation. Its sample deployment requires session duration not to exceed the IAM role's MaxSessionDuration and matching configured certificate attributes. ### Source excerpt Using temporary credentials is a security best practice to reduce the risk from credentials getting compromised. With AWS IAM Roles Anywhere, now your workloads outside of Amazon Web Services (AWS) will be able to access AWS resources by obtaining temporary security credentials in AWS Identity and Access Management (IAM). IAM Roles Anywhere relies on public [...] ## Netflix Bridges AWS IAM and Internal Identity with Workload Attestation DevFeed: [Netflix Bridges AWS IAM and Internal Identity with Workload Attestation]() Original publisher: [Read original article]() Author: Leela Kumili Published: 2026-10-21T13:45:00Z Content type: article Language: en Sources: [InfoQ]() Topics: [AWS IAM](), [App attestation](), [AWS Security Token Service](), [control-plane](), [Amazon Web Services]() Tags: [allows](), [amazon](), [amazon-emr](), [apache-spark](), [architecture-design](), [attestation](), [authentication](), [aws](), [aws-iam](), [certificates](), [combines](), [compute](), [control-plane](), [credentials](), [development](), [devops](), [distributed-systems](), [emr](), [iam](), [identity](), [identity-management](), [jobs](), [managed](), [mapreduce](), [mechanism](), [netflix](), [netflix-workload-attestation-aws](), [news](), [security](), [service-identification](), [services](), [spark]() ### AI overview Netflix's design lets Spark jobs on Amazon EMR use AWS IAM identity to obtain short-lived internal Metatron X.509 certificates without manually injecting credentials. The control plane maps each Data Project to a dedicated IAM role, signs metadata identifying the intended workload, and distributes roles across dedicated AWS accounts to accommodate many projects. The driver presents an AWS STS GetCallerIdentity pre-signed request; Netflix's Identity service checks the independently verified AWS role against the signed metadata before issuing a certificate. For executor fan-out, the driver attests once and sends credentials over authenticated, encrypted Spark RPC, avoiding per-executor attestation traffic while making the driver a credential-distribution trust boundary. The driver periodically re-attests before its certificate expires; executors do not renew independently. The text says the pattern may also apply to other managed environments with cloud identities and a separate organizational identity. ### Source excerpt Netflix has developed a workload attestation mechanism for Apache Spark jobs running on Amazon EMR. The design combines AWS IAM identity with signed claims from Netflix's control plane before issuing short-lived internal X.509 certificates, allowing managed compute workloads to authenticate to internal services without directly injecting credentials. By Leela Kumili ## High availability for everyone with multi-site Red Hat build of Keycloak on Red Hat OpenShift DevFeed: [High availability for everyone with multi-site Red Hat build of Keycloak on Red Hat OpenShift]() Original publisher: [Read original article]() Author: Jerczey Godoy Published: 2026-10-21T13:02:19Z Content type: article Language: en Sources: [Red Hat](), [Red Hat Developer]() Topics: [Keycloak](), [Availability](), [redhat](), [Load Balancing]() Tags: [authentication](), [availability](), [azure](), [cloud](), [enterprise](), [high-availability](), [iam](), [identity-and-access-management](), [keycloak](), [openshift](), [security]() ### AI overview Starting with Red Hat build of Keycloak 26.4, stateless multi-site HA supports fallback deployments across independent OpenShift clusters using supported databases and load balancers. It stores cross-site session data in a shared, consistent database while keeping Infinispan caches local, and uses one public OIDC issuer plus `/lb-check` probes so an external load balancer can route around a degraded site. A local two-site proof of concept used synchronous PostgreSQL replication and HAProxy; when Site A's Keycloak instances were stopped, traffic moved to Site B and the tested SPA session and token refresh continued without interruption. The excerpt also reports successful authorization-code-with-PKCE and RFC 8693 token-exchange failover tests. Setup findings include matching the public hostname and issuer across sites, specifying custom ports in the hostname configuration, and disabling OpenShift router stickiness. The demonstration was a LAN lab; it does not establish production performance or requirements. ### Source excerpt Identity and access management (IAM) is at the very core of your enterprise's runtime infrastructure. When authentication services fail, otherwise healthy application workloads instantly lock up, blocking users and disconnecting platform services. But high-availability setups for these services have historically been operationally complex, rigid, and restricted to heavy cloud architectures. The post High availability for everyone with multi-site Red Hat build of Keycloak on Red Hat OpenShift appeared first on Red Hat Developer. ## Building Node.js applications with Sequelize ORM and Amazon Aurora DSQL DevFeed: [Building Node.js applications with Sequelize ORM and Amazon Aurora DSQL]() Original publisher: [Read original article]() Author: Lasita Bhattacharya Published: 2026-10-14T15:56:52Z Content type: tutorial Language: en Sources: [AWS Database Blog]() Topics: [DSQL](), [Amazon Aurora](), [Eloquent ORM]() Tags: [advanced-300](), [amazon-aurora](), [aws](), [concurrency-control](), [dsql](), [iam](), [node-js](), [optimistic-concurrency](), [orm](), [retry-logic](), [technical-how-to]() ### AI overview This tutorial builds a hotel reservation application using Sequelize ORM with Amazon Aurora DSQL. It explains PostgreSQL compatibility and connector setup, UUID keys and relationship modeling, IAM authentication, single-statement DDL, and optimistic concurrency retries with backoff. It also covers least-privilege access, TLS, networking, connection pooling, monitoring, and cleanup. ### Source excerpt Node.js teams can run Sequelize ORM on Amazon Aurora DSQL with only a few adaptations. This post builds a hotel reservation application that shows reusable patterns: UUID primary keys, IAM authentication through the Aurora DSQL connector, individual DDL execution, and optimistic concurrency control retry logic. ## How attackers maintained persistence in AWS after stealing credentials DevFeed: [How attackers maintained persistence in AWS after stealing credentials]() Original publisher: [Read original article]() Author: info@1password.com (Gabriel Avner) Published: 2026-10-14T00:00:00Z Content type: article Language: en Sources: [1Password]() Topics: [credential-based attacks](), [AWS IAM](), [identity and access management](), [Secrets Management](), [aws inspector](), [Amazon GuardDuty](), [fake account fraud](), [Nitro Isolation Engine]() Tags: [1password](), [agent-identity](), [ai](), [aws](), [credentials](), [cyberattack](), [iam](), [infrastructure](), [security](), [zero-standing-privilege]() ### AI overview The article describes an AWS cryptomining campaign in which attackers used stolen IAM credentials to provision EC2 and ECS resources, create roles, and make instances harder to terminate. It recommends Zero Standing Privilege controls such as temporary, task-scoped access and presents 1Password Privileged Access as a way to implement them. ### Source excerpt In the cloud, attackers don't need to break in. They just need a working set of keys. Several AWS customers learned this the hard way when threat actors used compromised IAM credentials to deploy a rapid cryptomining campaign across EC2 and ECS environments. The incident didn't rely on vulnerabilities or sophisticated exploitation; it simply relied on valid credentials and overly permissive access. Below is a clear breakdown of what happened, what matters, and how organizations can strengthen their defenses using a Zero Standing Privilege (ZSP) approach. What happened during the AWS cyberattack When an attack of this scale occurs, it's important to understand how attackers gained access and what they did with it. How the attackers gained initial access According to reporting from Dark Reading, as well as AWS's own analysis, attackers used stolen IAM credentials to authenticate into customer environments and immediately begin provisioning cryptomining workloads. The campaign was active across multiple AWS customers, who were directly notified. AWS also confirmed this was not the result of a flaw in its infrastructure. The privileges attached to the compromised identity permitted every action the attackers took. Once inside, the attackers: Targeted EC2 and ECS resources to spin up mining infrastructure Used automation to deploy workloads within about 10 minutes of initial access Leveraged AWS APIs to create new roles, extending their control Enabled persistence by modifying instance attributes to make resources harder to terminate This combination of legitimate access and rapid provisioning made the campaign highly effective and very difficult to stop in its early stages. For full details, you can read the AWS security blog here. How the attackers stayed in control After gaining access, the attackers created two new IAM roles using the victim's own permissions to achieve their goals and persistence: A service-linked role for Auto Scaling groups A Lambda execution role ## Scale your team's use of AWS IAM account access manager with Pulumi DevFeed: [Scale your team's use of AWS IAM account access manager with Pulumi]() Original publisher: [Read original article]() Author: Tatiana Cooke Published: 2026-10-14T00:00:00Z Content type: tutorial Language: en Sources: [Pulumi]() Topics: [pulumi](), [AWS IAM](), [Access Control](), [Single sign-on (SSO)](), [Security, Identity, & Compliance](), [CI/CD]() Tags: [administrator](), [aws](), [aws-iam](), [aws-iam-identity-center](), [iam](), [iam-identity-center](), [iam-roles](), [infrastructure-as-code](), [partner](), [product](), [pulumi](), [sdks](), [security]() ### AI overview This tutorial explains how to manage AWS IAM account access manager (AAM) with Pulumi. It covers defining IAM roles, applications, and entitlements as code, scaling group-to-role assignments across AWS accounts, and using policy checks and review workflows. A digital bank is described as adopting AAM to move workforce access to IAM Identity Center while managing roles and entitlements in Pulumi. ### Source excerpt In September 2026, AWS launched AWS IAM account access manager (AAM), which lets administrators assign IAM roles to workforce users and groups in AWS IAM Identity Center. AAM combines IAM Identity Center's single federation point and user awareness with the flexibility of IAM roles. Today, as part of our partner launch enablement, we're pleased to share that you can manage AAM as code with Pulumi. The accountaccess resources ship in the Pulumi AWS provider (v7.45.0 and later) and in the Pulumi AWS Cloud Control provider, AWS Native (v1.75.0 and later), with SDKs generated for every Pulumi language: TypeScript, Python, Go, C#, Java, HCL, and YAML. Teams that already manage their AWS organization with Pulumi can adopt AAM in the same stacks, languages, and review workflows they use today. If you're not using Pulumi today, this post demonstrates how infrastructure as code can help you adopt new AWS services and securely scale them out to your organization faster. In this post, we explain where AAM fits alongside permission sets. We walk through defining roles, applications, and entitlements as code, and we describe how one financial services customer is using this pattern to move its workforce access to IAM Identity Center. The challenge: flexible roles vs. centralized access Until now, organizations managing human access across many AWS accounts have had to choose between two approaches. IAM Identity Center permission sets provide a single sign-on experience and centralized user awareness. IAM Identity Center provisions a permission set into each account as a uniform role. That works well for baseline access, such as read-only or administrator access that looks the same everywhere. But many enterprises need roles that differ from account to account. These roles carry account-specific policies, tags for attribute-based access control (ABAC), custom trust policies, or role paths that encode team and environment. As organizations add accounts, teams, and specialized role ## Quantum-resistant signing on AWS, Part 2: Enforce your ML-DSA algorithm policy with SCPs and IAM DevFeed: [Quantum-resistant signing on AWS, Part 2: Enforce your ML-DSA algorithm policy with SCPs and IAM]() Original publisher: [Read original article]() Author: Harshvardhan Chunawala Published: 2026-10-12T20:13:06Z Content type: tutorial Language: en Sources: [AWS Security Blog]() Topics: [Post-quantum cryptography](), [Amazon Web Services](), [AWS IAM](), [Cryptography](), [Security, Identity, & Compliance]() Tags: [amazon-elastic-container-registry](), [amazon-elastic-kubernetes-service](), [amazon-inspector](), [amazon-simple-storage-service-s3](), [aws](), [aws-cli](), [aws-cloudtrail](), [aws-identity-and-access-management-iam](), [aws-key-management-service](), [aws-private-certificate-authority](), [aws-secrets-manager](), [aws-security-token-service](), [aws-systems-manager](), [best-practices](), [compliance](), [configuration-compliance-and-auditing](), [expert-400](), [iam](), [ml-dsa](), [post-quantum](), [post-quantum-cryptography](), [quantum-technologies](), [security](), [security-blog](), [security-identity-compliance](), [supply-chain](), [technical-how-to]() ### AI overview The article shows how to enforce an organization's ML-DSA algorithm policy on AWS using service control policies, IAM policies and permission boundaries. It explains how to block creation and use of excluded ML-DSA-44 keys while preserving approved variants, and how to control certificate-authority and TLS certificate paths through provisioning restrictions and detection. It also describes limitations, operational trade-offs, and the need to review controls as algorithms and AWS services evolve. ### Source excerpt You want to set a cryptographic algorithm policy and stop non-compliant choices from being made in your Amazon Web Services (AWS) environment. This post shows you how. As you adopt post-quantum cryptography, one of the first decisions you face is which algorithms and parameter sets fit your business needs, balancing security against signature size, key [...] ## Accessing OpenAI GPT models on Amazon Bedrock with global cross-Region inference in Thailand, Malaysia, Singapore, Indonesia, and Taiwan DevFeed: [Accessing OpenAI GPT models on Amazon Bedrock with global cross-Region inference in Thailand, Malaysia, Singapore, Indonesia, and Taiwan]() Original publisher: [Read original article]() Author: Traci Lim Published: 2026-10-12T17:52:22Z Content type: tutorial Language: en Sources: [Artificial Intelligence]() Topics: [ChatGPT API](), [AI Infrastructure](), [Azure OpenAI](), [OpenAI]() Tags: [access-management](), [advanced-300](), [amazon-bedrock](), [amazon-cloudwatch](), [amazon-cloudwatch-logs](), [amazon-s3](), [asia-pacific](), [authentication](), [authorization](), [aws](), [aws-cloudtrail](), [gpt](), [gpt-6](), [iam](), [indonesia](), [inference](), [malaysia](), [permissions](), [quota](), [singapore](), [taiwan](), [technical-how-to]() ### AI overview The tutorial explains how to invoke GPT-6 Sol, Luna, and Astra on Amazon Bedrock through global cross-Region inference from selected Asia Pacific Regions. It covers Converse and OpenAI-compatible APIs, IAM and service control policy configuration, quota sizing, data retention, and monitoring calls from the source Region. ### Source excerpt Learn how to run OpenAI GPT-6 Sol, Luna, and Astra on Amazon Bedrock through global cross-Region inference from Singapore, Jakarta, Thailand, Malaysia, and Taipei. This post covers the Converse and OpenAI-compatible APIs, IAM and SCP permissions, quota sizing, and monitoring inference from your source Region. ## AI Platform Vendors Build Repeatable Self-Hosted Deployment Processes DevFeed: [AI Platform Vendors Build Repeatable Self-Hosted Deployment Processes]() Original publisher: [Read original article]() Author: Munib Ali Published: 2026-10-07T15:59:50Z Content type: article Language: en Sources: [Fairwinds]() Topics: [platform engineering automation](), [Homelab](), [Deployment Strategies](), [Kubernetes](), [Self Hosted AI Tools](), [Managed Services](), [Access Control]() Tags: [artificial-intelligence](), [deployment](), [iam](), [infrastructure](), [kubernetes](), [managed-kubernetes](), [onboarding](), [security](), [self-hosted-ai]() ### AI overview Self-hosted AI platform deployments depend on coordination across customer application, platform, security, network, identity, and change-management teams. The article recommends defining prerequisites and customer owners, using pre-flight validation and a readiness gate before scheduling installations, and documenting post-deployment responsibilities and support. It presents repeatable customer-hosted deployment processes as part of an AI product vendor's delivery model. ### Source excerpt TL;DR Self-hosted AI platform deployments require more than a working installer. They depend on coordination across the customer's application, platform, security, network, IAM, and change-management teams. The installation may be a small part of the overall engagement. Access requests, security reviews, firewall changes, and maintenance-window approvals can extend the delivery timeline. A repeatable onboarding motion needs clear technical prerequisites, named customer owners, pre-flight validation, and defined post-deployment responsibilities. AI platform vendors need a defined support model for customer-hosted installations, including deployment-process review, active deployment support, and direct customer support for complex installations. For software vendors selling AI platforms into enterprise accounts, customer-hosted deployments may be part of the commercial and technical requirements for a deal. Customers may require software to run in their own Amazon Web Services (AWS) account, Google Cloud Platform (GCP) project, Azure subscription, or Kubernetes cluster because of data residency requirements, internal security policies, or a need to retain control of the underlying infrastructure. ## Cybersecurity jobs available right now: October 6, 2026 DevFeed: [Cybersecurity jobs available right now: October 6, 2026]() Original publisher: [Read original article]() Author: Anamarija Pogorelec Published: 2026-10-06T04:00:58Z Content type: news Language: en Sources: [Help Net Security]() Topics: [Cybersecurity](), [identity and access management](), [Incident response](), [Application Security]() Tags: [2026](), [access-management](), [authentication](), [bmo](), [cybersecurity](), [cybersecurity-jobs](), [entra-id](), [iam](), [jobs](), [national-security-agency](), [news]() ### AI overview A roundup of cybersecurity openings across identity and access management, network defense, policy, security engineering, incident response, and product security. Roles span multiple countries, seniority levels, and work arrangements; some listings note that applications are no longer being accepted. ### Source excerpt Associate IAM Engineer New York City Office of Technology & Innovation | USA | On-site - View job details As an Associate IAM Engineer, you will support daily identity and access management operations in Microsoft Entra ID and related platforms. You will manage users, groups, access provisioning, and role assignments, resolve authentication issues and support tickets, and help maintain stable IAM services. You will also document procedures, a Computer Network Defense Analyst National Security Agency ... More -> The post Cybersecurity jobs available right now: October 6, 2026 appeared first on Help Net Security. [Next page]()