# AWS Identity and Access Management (IAM) AWS service for securely controlling access to AWS resources by managing permissions, authentication, and authorization. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Operationalizing least privilege: Automate IAM remediation through your CI/CD pipeline DevFeed: [Operationalizing least privilege: Automate IAM remediation through your CI/CD pipeline]() Original publisher: [Read original article]() Author: Luis Pastor Published: 2026-09-15T15:53:51Z Content type: tutorial Language: en Sources: [AWS Security Blog]() Topics: [AWS Identity and Access Management (IAM)](), [CI/CD](), [Infrastructure as code](), [AWS CloudFormation](), [Amazon Web Services]() Tags: [aws](), [aws-cloudformation](), [aws-cloudtrail](), [aws-iam](), [aws-identity-and-access-management-iam](), [aws-organizations](), [best-practices](), [ci-cd](), [expert-400](), [iam](), [infrastructure-as-code-iac](), [least-privilege](), [pull-request](), [security](), [security-blog](), [security-identity-compliance](), [technical-how-to]() ### AI overview This article describes an automated workflow for operationalizing least privilege in AWS. It explains how AWS IAM Access Analyzer identifies unused permissions and how remediation can be routed through different paths for infrastructure-as-code-managed, manually created, and unused IAM principals. ### Source excerpt The principle of least privilege is straightforward to articulate but challenging to maintain at scale. When teams first deploy applications to AWS, they often grant broader permissions than strictly necessary; it's faster to get things working, and the plan is always to tighten permissions later. But later rarely comes. Permissions accumulate, AWS Identity and Access [...] ## Set Up Cloud OIDC From the Pulumi CLI DevFeed: [Set Up Cloud OIDC From the Pulumi CLI]() Original publisher: [Read original article]() Author: Sean Yeh Published: 2026-09-11T00:00:00Z Content type: tutorial Language: en Sources: [Pulumi]() Topics: [OpenID connect (OIDC)](), [Command-line interface](), [AWS IAM](), [Cloud](), [AWS Identity and Access Management (IAM)](), [Azure](), [Google Cloud Platform (GCP)]() Tags: [automated](), [aws](), [azure](), [cli](), [cloud](), [configuration](), [docs](), [esc](), [google-cloud](), [how-to](), [iam](), [identity](), [oidc](), [openid-connect](), [product](), [pulumi](), [pulumi-cli](), [security](), [terminal](), [workflow]() ### AI overview This tutorial explains how to use the Pulumi CLI command pulumi env setup to configure Pulumi ESC as an OIDC provider for AWS, Azure, and Google Cloud. It covers interactive onboarding, non-interactive flags for scripts and agents, cloud credentials, account selection, access policies, and automatic creation of identity providers, IAM roles, policy attachments, and ESC environments. ### Source excerpt Pulumi ESC can act as an OpenID Connect (OIDC) provider for AWS, Azure, and Google Cloud, issuing short-lived, signed tokens that these clouds exchange for temporary credentials. This eliminates hard-coded credentials and improves your security posture. Last year, we introduced an onboarding flow in the Pulumi Cloud console that makes it super easy to configure OIDC for your cloud provider in a few guided steps. We're bringing Pulumi Cloud into the CLI so agents can use its capabilities directly from the terminal, without requiring a human to complete steps in the console. The new pulumi env setup command brings OIDC onboarding to that workflow, with interactive prompts for guided setup and non-interactive flags for scripts and agents. pulumi env setup - how it works Run the command with your desired cloud provider (aws, azure, gcp). For example: pulumi env setup aws The command then asks what it needs to configure your cloud, including your credentials, the accounts to configure, and the level of access. The questions differ per cloud. For AWS, it asks: How to authenticate to AWS. It uses the credentials you already have, or it signs you in with AWS SSO. Which accounts to configure. Which policy to attach to the OIDC role. Choose AdministratorAccess for Pulumi Deployments, ReadOnlyAccess for Pulumi Insights, or any other policy ARN. Then, it will print out the plan: About to configure OIDC for organization my-org: account 111111111111: create role pulumi-esc-oidc-622e86ea-319ba4c675bb3c00-role attach arn:aws:iam::aws:policy/AdministratorAccess create ESC environment my-org/aws-login/sandbox-account-env Proceed? [yes/no] After you confirm, the command creates the identity provider, the IAM role, and the policy attachment in each account. It then creates one ESC Environment per account, with the aws-login provider already configured. Non-interactive setup You can also run the command without interactive prompts by passing in the necessary flags. Each cloud has its ow ## Testing application resilience with Amazon SQS and AWS Fault Injection Service DevFeed: [Testing application resilience with Amazon SQS and AWS Fault Injection Service]() Original publisher: [Read original article]() Author: Richard Whitworth Published: 2026-09-09T21:33:59Z Content type: tutorial Language: en Sources: [AWS Architecture Blog]() Topics: [Amazon Simple Queue Service (SQS)](), [AWS Fault Injection Service (FIS)](), [Chaos Engineering](), [AWS IAM](), [AWS Identity and Access Management (IAM)]() Tags: [advanced-300](), [amazon-cloudwatch](), [amazon-simple-queue-service-sqs](), [amazon-sqs](), [automation](), [aws](), [aws-fault-injection-service-fis](), [experiments](), [how-to](), [iam](), [observability](), [resilience](), [technical-how-to](), [testing]() ### AI overview A tutorial on testing application resilience when Amazon SQS data-plane operations fail. It uses AWS Fault Injection Service and Systems Manager Automation to progressively deny queue access, evaluate recovery and observability with CloudWatch metrics, and avoid IAM deny-policy lockouts. ### Source excerpt Learn how to use AWS Fault Injection Service and AWS Systems Manager Automation to run progressive chaos experiments against Amazon SQS queues. Validate that your retry logic, circuit breakers, and dead-letter queues actually work under failure before a real outage hits production. ## Break-glass access for Amazon EKS when federated identity fails DevFeed: [Break-glass access for Amazon EKS when federated identity fails]() Original publisher: [Read original article]() Author: Sam Mukherjee Published: 2026-08-26T16:20:28Z Content type: article Language: en Sources: [Containers]() Topics: [Amazon EKS](), [AWS Identity and Access Management (IAM)](), [Infrastructure as code](), [MFA](), [Authorization](), [iac-security](), [migration]() Tags: [advanced-300](), [amazon-eks](), [amazon-elastic-kubernetes-service](), [aws-iam](), [best-practices](), [identity-and-access-management](), [infrastructure-as-code](), [mfa](), [migration](), [technical-how-to]() ### AI overview This post presents a break-glass access pattern for Amazon EKS clusters when a federated identity provider fails. It describes a dedicated cross-account IAM role with enforced, recency-aware MFA, infrastructure-as-code templates, validation tests, and post-incident recovery procedures. ### Source excerpt Implementing break-glass access for Amazon EKS clusters removes the circular dependency where a federated identity provider outage locks you out of the clusters you need to reach to fix it. This post supplies a cross-account IAM role with enforced MFA, infrastructure-as-code templates, validation tests, and a post-incident recovery procedure. ## Propagate user authorization context in AI agents with Amazon Bedrock AgentCore DevFeed: [Propagate user authorization context in AI agents with Amazon Bedrock AgentCore]() Original publisher: [Read original article]() Author: Anshu Bathla Published: 2026-08-19T17:24:15Z Content type: article Language: en Sources: [AWS Security Blog]() Topics: [Amazon Bedrock AgentCore](), [AI Agent](), [Authorization](), [AWS Identity and Access Management (IAM)](), [Amazon Bedrock Knowledge Bases](), [Amazon DynamoDB](), [Amazon S3](), [prompt injection](), [Amazon Web Services](), [Software as a service]() Tags: [access-control](), [advanced-300](), [ai-agents](), [amazon-bedrock](), [amazon-bedrock-agentcore](), [amazon-bedrock-knowledge-bases](), [amazon-dynamodb](), [amazon-s3](), [artificial-intelligence](), [authorization](), [aws](), [prompt-injection](), [security-blog](), [security-identity-compliance](), [technical-how-to]() ### AI overview This article explains how to propagate user authorization context through AI agents built with Amazon Bedrock AgentCore. It presents a pattern for enforcing least-privilege access in downstream data services and infrastructure, so agents can access DynamoDB, Bedrock Knowledge Bases, S3-backed documents, and other sources only within the requesting user's permissions. ### Source excerpt Many teams now deploy AI agents that pull from Amazon DynamoDB tables, document repositories, software as a service (SaaS) platforms, and internal knowledge bases to answer questions and automate workflows. A key risk in these deployments is that the agent has no awareness of who's asking, so it might return data the user shouldn't see. [...] ## Secure Workload Identity with SPIRE and OIDC: A Guide for Kubernetes and Istio Users DevFeed: [Secure Workload Identity with SPIRE and OIDC: A Guide for Kubernetes and Istio Users]() Original publisher: [Read original article]() Author: Nikhil Arora Published: 2024-07-03T15:52:26Z Content type: tutorial Language: en Sources: [Indeed]() Topics: [SPIRE](), [istio](), [Kubernetes](), [OpenID connect (OIDC)](), [Zero Trust](), [AWS Identity and Access Management (IAM)](), [Architecture & Design]() Tags: [authentication](), [authorization](), [aws-iam](), [credentials](), [guide](), [identity](), [istio](), [kubernetes](), [oidc](), [secrets](), [spire](), [unsorted](), [zero-trust]() ### AI overview This guide describes Indeed's approach to building a workload identity platform for Kubernetes and Istio using SPIRE and OIDC, with identities and access controls rooted in Zero Trust principles. It discusses credential risks, design choices, and implementation challenges for heterogeneous first-party and third-party workloads. ### Source excerpt Goal This blog is for engineering teams, architects, and leaders responsible for defining and implementing a workload identity platform and access controls rooted in Zero Trust principles to mitigate the risks from compromised services. It is relevant for companies using Kubernetes to manage workloads, using Istio for service mesh, and aiming to define identities in [...] ## Security in AWS: IAM Best Practices and Advanced Techniques DevFeed: [Security in AWS: IAM Best Practices and Advanced Techniques]() Original publisher: [Read original article]() Author: Guillermo Ojeda Published: 2024-03-20T00:41:01Z Content type: tutorial Language: en Sources: [Guille Ojeda]() Topics: [AWS Identity and Access Management (IAM)](), [IAM](), [Security](), [Access Control](), [Authorization](), [Infrastructure as code]() Tags: [access-control](), [aws](), [aws-iam](), [best-practices](), [cloud](), [iam](), [infrastructure-as-code](), [json](), [security](), [techniques]() ### AI overview A tutorial on AWS IAM fundamentals, best practices, and advanced techniques. It covers users, groups, roles, IAM policies, granular access control, cross-account access, and automating IAM with Infrastructure as Code. ### Source excerpt AWS IAM (Identity and Access Management) is the backbone of any AWS security strategy. It's the service that controls who can access your AWS resources and what actions they can perform. Get IAM right, and you're well on your way to a secure cloud de... ## AWS IAM Access for multiple AWS accounts and products DevFeed: [AWS IAM Access for multiple AWS accounts and products]() Original publisher: [Read original article]() Author: info@goteleport.com (Kai Davenport) Published: 2022-01-26T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [AWS Identity and Access Management (IAM)](), [Amazon Web Services](), [Amazon EC2](), [Amazon S3]() Tags: [aws](), [aws-iam](), [backups](), [console](), [database](), [engineering](), [iam](), [monitoring](), [mysql](), [postgres](), [products](), [teams]() ### AI overview This article describes how Teleport enables AWS IAM access across multiple AWS accounts and products as engineering teams scale. It illustrates the operational risks of broad or difficult-to-standardize access, including accidental deletion of RDS instances, and notes that backups enabled restoration within an hour. ### Source excerpt This article describes how Teleport enables AWS IAM Access Across Multiple AWS Accounts and Products so engineering teams stay productive while their business scales. ## RBAC and ABAC with AWS IAM DevFeed: [RBAC and ABAC with AWS IAM]() Original publisher: [Read original article]() Author: info@goteleport.com (Shuo Yang) Published: 2021-07-12T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [AWS Identity and Access Management (IAM)](), [Access Control](), [IAM](), [Authorization]() Tags: [access-control](), [authorization](), [aws-iam](), [iam](), [identity](), [security]() ### AI overview This article explains role-based access control (RBAC) and attribute-based access control (ABAC) in AWS IAM. It describes how roles and groups can define privileges and how ABAC uses user, resource, and environment attributes to provide more fine-grained access control. ### Source excerpt When talking about application authorizations, we often encounter two concepts RBAC (role-based access control) and ABAC (attribute-based access control). ## How AWS IAM role, STS and Identity Pool work together DevFeed: [How AWS IAM role, STS and Identity Pool work together]() Original publisher: [Read original article]() Author: info@goteleport.com (Shuo Yang) Published: 2021-06-23T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [AWS IAM](), [AWS STS](), [Amazon Cognito](), [AWS Identity and Access Management (IAM)](), [Authentication](), [Authorization](), [Application Development](), [OpenID connect (OIDC)](), [Security]() Tags: [amazon-cognito](), [application-development](), [authentication](), [authorization](), [aws](), [aws-iam](), [aws-sts](), [cloud](), [oidc](), [security](), [services]() ### AI overview This tutorial explains how AWS IAM roles, AWS STS, and Amazon Cognito Identity Pools work together to let applications obtain temporary AWS credentials. It describes the flow from an OIDC token issued by a Cognito User Pool to temporary credentials obtained through STS and subsequent access to AWS resources. ### Source excerpt Learn how to access AWS resources using Cognito Identity Pool in combination with AWS STS to provide temporary credentials without long-lived keys. ## AWS IAM in layman's terms DevFeed: [AWS IAM in layman's terms]() Original publisher: [Read original article]() Author: info@goteleport.com (Shuo Yang) Published: 2021-06-16T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [AWS Identity and Access Management (IAM)](), [IAM](), [Access Control](), [Authorization](), [Development](), [Security](), [Infrastructure as code]() Tags: [access-control](), [aws-iam](), [development](), [diagram](), [figure](), [how-to](), [iam](), [infrastructure-as-code-iac](), [policy](), [security]() ### AI overview This tutorial explains AWS IAM roles, STS, identity pools, and IAM policy mechanisms. It focuses on separating access-control responsibilities between central security or platform teams and individual application development teams, including the interaction between permission boundaries and identity-based policies. ### Source excerpt Learn how to leverage the right AWS IAM policy mechanisms to build responsibility separation between a central platform team and individual development teams.