 |
Right this moment, we’re saying the overall availability of AWS IAM Identification Heart multi-Area help to allow AWS account entry and managed software use in extra AWS Areas.
With this function, you’ll be able to replicate your workforce identities, permission units, and different metadata in your group occasion of IAM Identification Heart related to an exterior identification supplier (IdP), similar to Microsoft Entra ID and Okta, from its present major Area to extra Areas for improved resiliency of AWS account entry.
You may also deploy AWS managed purposes in your most popular Areas, near software customers and datasets for improved person expertise or to satisfy information residency necessities. Your purposes deployed in extra Areas entry replicated workforce identities domestically for optimum efficiency and reliability.
Whenever you replicate your workforce identities to a further Area, your workforce will get an energetic AWS entry portal endpoint in that Area. Which means that within the unlikely occasion of an IAM Identification Heart service disruption in its major Area, your workforce can nonetheless entry their AWS accounts by means of the AWS entry portal in a further Area utilizing already provisioned permissions. You’ll be able to proceed to handle IAM Identification Heart configurations from the first Area, sustaining centralized management.
Allow IAM Identification Heart in a number of Areas
To get began, it’s best to verify that the AWS managed purposes you’re presently utilizing help buyer managed AWS Key Administration Service (AWS KMS) key enabled in AWS Identification Heart. Once we launched this function in October 2025, Seb beneficial utilizing multi-Area AWS KMS keys except your organization insurance policies prohibit you to single-Area keys. Multi-Area keys present constant key materials throughout Areas whereas sustaining unbiased key infrastructure in every Area.
Earlier than replicating IAM Identification Heart to a further Area, you have to first replicate the client managed AWS KMS key to that Area and configure the reproduction key with the permissions required for IAM Identification Heart operations. For directions on creating multi-Area reproduction keys, confer with Create multi-Area reproduction keys within the AWS KMS Developer Information.
Go to the IAM Identification Heart console within the major Area, for instance, US East (N. Virginia), select Settings within the left-navigation pane, and choose the Administration tab. Affirm that your configured encryption secret is a multi-Area buyer managed AWS KMS key. So as to add extra Areas, select Add Area.
You’ll be able to select extra Areas to duplicate the IAM Identification Heart in a listing of the accessible Areas. When selecting a further Area, contemplate your supposed use instances, for instance, information compliance or person expertise.
If you wish to run AWS managed purposes that entry datasets restricted to a particular Area for compliance causes, select the Area the place the datasets reside. When you plan to make use of the extra Area to deploy AWS purposes, confirm that the required purposes help your chosen Area and deployment in extra Areas.
Select Add Area. This begins the preliminary replication whose period is dependent upon the dimensions of your Identification Heart occasion.
After the replication is accomplished, your customers can entry their AWS accounts and purposes on this new Area. Whenever you select View ACS URLs, you’ll be able to view SAML data, similar to an Assertion Client Service (ACS) URL, in regards to the major and extra Areas.
How your workforce can use a further Area
AWS Identification Heart helps SAML single sign-on with exterior IdPs, similar to Microsoft Entra ID and Okta. Upon authentication within the IdP, the person is redirected to the AWS entry portal. To allow the person to be redirected to the AWS entry portal within the newly added Area, you should add the extra Area’s ACS URL to the IdP configuration.
The next screenshots present you the way to do that within the Okta admin console:
Then, you’ll be able to create a bookmark software in your identification supplier for customers to find the extra Area. This bookmark app capabilities like a browser bookmark and accommodates solely the URL to the AWS entry portal within the extra Area.
You may also deploy AWS managed purposes in extra Areas utilizing your current deployment workflows. Your customers can entry purposes or accounts utilizing the prevailing entry strategies, such because the AWS entry portal, an software hyperlink, or by means of the AWS Command Line Interface (AWS CLI).
To be taught extra about which AWS managed purposes help deployment in extra Areas, go to the IAM Identification Heart Person Information.
Issues to know
Listed below are key issues to find out about this function:
- Consideration – To make the most of this function at launch, you should be utilizing a company occasion of IAM Identification Heart related to an exterior IdP. Additionally, the first and extra Areas should be enabled by default in an AWS account. Account situations of IAM Identification Heart, and the opposite two identification sources (Microsoft Energetic Listing and IAM Identification Heart listing) are presently not supported.
- Operation – The first Area stays the central place for managing workforce identities, account entry permissions, exterior IdP, and different configurations. You need to use the IAM Identification Heart console in extra Areas with a restricted function set. Most operations are read-only, apart from software administration and person session revocation.
- Monitoring – All workforce actions are emitted in AWS CloudTrail within the Area the place the motion was carried out. This function enhances account entry continuity. You’ll be able to arrange break-glass entry for privileged customers to entry AWS if the exterior IdP has a service disruption.
Now accessible
AWS IAM Identification Heart multi-Area help is now accessible within the 17 enabled-by-default business AWS Areas. For Regional availability and a future roadmap, go to the AWS Capabilities by Area. You need to use this function at no extra value. Normal AWS KMS prices apply for storing and utilizing buyer managed keys.
Give it a strive within the AWS Identification Heart console. To be taught extra, go to the IAM Identification Heart Person Information and ship suggestions to AWS re:Put up for Identification Heart or by means of your typical AWS Help contacts.
— Channy