Books

AWS IAM Release Notes https://docs.aws.amazon.com/IAM/latest/UserGuide/ Document history for the AWS IAM User Guide. en-us Sat, 3 Aug 2024 01:02:58 GMT AccessAnalyzerServiceRolePolicy â€“ Added permissions https://docs.aws.amazon.com/IAM/latest/UserGuide/security-iam-awsmanpol.html IAM Access Analyzer added support for permission to retrieve information about IAM user and role policies to the service-level permissions of <a href="https://console.aws.amazon.com/iam/home#policies/AccessAnalyzerServiceRolePolicy" rel="noopener noreferrer" target="_blank">AccessAnalyzerServiceRolePolicy</a>. Thu, 30 May 2024 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#AccessAnalyzerServiceRolePolicy_â€“_Added_permissions_2024-05-30 AccessAnalyzerServiceRolePolicy â€“ Added permissions https://docs.aws.amazon.com/IAM/latest/UserGuide/security-iam-awsmanpol.html IAM Access Analyzer added support for permission to retrieve the current state of the block public access for Amazon EC2 snapshots to the service-level permissions of <a href="https://console.aws.amazon.com/iam/home#policies/AccessAnalyzerServiceRolePolicy" rel="noopener noreferrer" target="_blank">AccessAnalyzerServiceRolePolicy</a>. Tue, 23 Jan 2024 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#AccessAnalyzerServiceRolePolicy_â€“_Added_permissions_2024-01-23 AccessAnalyzerServiceRolePolicy â€“ Added permissions https://docs.aws.amazon.com/IAM/latest/UserGuide/security-iam-awsmanpol.html IAM Access Analyzer added DynamoDB streams and tables to the service-level permissions of <a href="https://console.aws.amazon.com/iam/home#policies/AccessAnalyzerServiceRolePolicy" rel="noopener noreferrer" target="_blank">AccessAnalyzerServiceRolePolicy</a>. Thu, 11 Jan 2024 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#AccessAnalyzerServiceRolePolicy_â€“_Added_permissions_2024-01-11 AccessAnalyzerServiceRolePolicy â€“ Added permissions https://docs.aws.amazon.com/IAM/latest/UserGuide/security-iam-awsmanpol.html IAM Access Analyzer added Amazon S3 directory buckets to the service-level permissions of <a href="https://console.aws.amazon.com/iam/home#policies/AccessAnalyzerServiceRolePolicy" rel="noopener noreferrer" target="_blank">AccessAnalyzerServiceRolePolicy</a>. Fri, 1 Dec 2023 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#AccessAnalyzerServiceRolePolicy_â€“_Added_permissions_2023-12-01 IAMAccessAnalyzerReadOnlyAccess â€“ Added permissions https://docs.aws.amazon.com/IAM/latest/UserGuide/security-iam-awsmanpol.html IAM Access Analyzer added permissions to <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/security-iam-awsmanpol.html#security-iam-awsmanpol-IAMAccessAnalyzerReadOnlyAccess">IAMAccessAnalyzerReadOnlyAccess</a> to allow you to check whether updates to your policies grant additional access. Sun, 26 Nov 2023 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#IAMAccessAnalyzerReadOnlyAccess_â€“_Added_permissions_2023-11-26 IAM Access Analyzer added unused access analyzers https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html#what-is-access-analyzer-unused-access-analysis IAM Access Analyzer simplifies inspecting unused access to guide you toward least privilege. IAM Access Analyzer continuously analyzes your accounts to identify unused access and creates a centralized dashboard with findings. Sun, 26 Nov 2023 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#IAM_Access_Analyzer_added_unused_access_analyzers_2023-11-26 IAM Access Analyzer added custom policy checks https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-custom-policy-checks.html IAM Access Analyzer now provides custom policy checks to validate that IAM policies adhere to your security standards ahead of deployments. Sun, 26 Nov 2023 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#IAM_Access_Analyzer_added_custom_policy_checks_2023-11-26 AccessAnalyzerServiceRolePolicy â€“ Added permissions https://docs.aws.amazon.com/IAM/latest/UserGuide/security-iam-awsmanpol.html IAM Access Analyzer added IAM actions to the service-level permissions of <a href="https://console.aws.amazon.com/iam/home#policies/AccessAnalyzerServiceRolePolicy" rel="noopener noreferrer" target="_blank">AccessAnalyzerServiceRolePolicy</a> to support the following actions: Sun, 26 Nov 2023 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#AccessAnalyzerServiceRolePolicy_â€“_Added_permissions_2023-11-26 Action last accessed information and policy generation support for over 60 additional services and actions https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_access-advisor-action-last-accessed.html IAM now supports action last accessed information and <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-policy-generation-action-last-accessed-support.html">generates policies with action-level information</a> for over 60 additional services, along with a list of the actions for which action last accessed information is available. Wed, 1 Nov 2023 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#Action_last_accessed_information_and_policy_generation_support_for_over_60 _______________additional_services_and_actions_2023-11-01 Action last accessed information support for over 140 services https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_access-advisor-action-last-accessed.html IAM now provides action last accessed information for more than 140 services, along with a list of the actions for which action last accessed information is available. Thu, 14 Sep 2023 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#Action_last_accessed_information_support_for_over_140_services_2023-09-14 Support for multiple multi-factor authentication (MFA) devices for root users and IAM users https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa.html Now you can to add up to eight MFA devices per user, including FIDO security keys, software time-based one-time password (TOTP) with virtual authenticator applications, or hardware TOTP tokens. Wed, 16 Nov 2022 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#Support_for_multiple_multi-factor_authentication_(MFA)_devices_for_root_users_and _______________IAM_users_2022-11-16 IAM Access Analyzer support for new resource types https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-resources.html IAM Access Analyzer added support for the following resource types: Tue, 25 Oct 2022 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#IAM_Access_Analyzer_support_for_new_resource_types_2022-10-25 U2F deprecation and WebAuthn/FIDO update https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa.html Removed mentions of U2F as an MFA option and added information about WebAuthn, FIDO2, and FIDO security keys. Tue, 31 May 2022 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#U2F_deprecation_and_WebAuthn/FIDO_update_2022-05-31 Updates to resilience in IAM https://docs.aws.amazon.com/IAM/latest/UserGuide/disaster-recovery-resiliency.html Added information about maintaining access to IAM credentials when an event disrupts communication between AWS Regions. Mon, 16 May 2022 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#Updates_to_resilience_in_IAM_2022-05-16 New global condition keys for resources https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourceaccount You can now control access to resources based on the account, Organizational Unit (OU), or organization in AWS Organizations that contains your resources. You can use the <code class="code">aws:ResourceAccount</code>, <code class="code">aws:ResourceOrgID</code>, and <code class="code">aws:ResourceOrgPaths</code> global condition keys in an IAM policy. Wed, 27 Apr 2022 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#New_global_condition_keys_for_resources_2022-04-27 Code examples for IAM using AWS SDKs https://docs.aws.amazon.com/IAM/latest/UserGuide/service_code_examples.html Added code examples that show how to use IAM with an AWS software development kit (SDK). The examples are divided into code excerpts that show you how to call individual service functions and examples that show you how to accomplish a specific task by calling multiple functions within the same service. Thu, 7 Apr 2022 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#Code_examples_for_IAM_using_AWS_SDKs_2022-04-07 Updates to policy evaluation logic flow chart https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html#policy-eval-denyallow Updates to the policy evaluation logic flow chart and related text in the <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html#policy-eval-denyallow">Determining whether a request is allowed or denied within an account</a> section. Wed, 17 Nov 2021 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#Updates_to_policy_evaluation_logic_flow_chart_2021-11-17 Updates to security best practices https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html Added information about creating administrative users instead of using root user credentials, removed the best practice of using user groups to assign permissions to IAM users, and clarified when to use managed policies instead of inline policies. Tue, 5 Oct 2021 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#Updates_to_security_best_practices_2021-10-05 Updates to policy evaluation logic topic for resource-based policies https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html#policy-eval-denyallow Added information about the impact of resource-based policies and different principal types in the same account. Tue, 5 Oct 2021 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#Updates_to_policy_evaluation_logic_topic_for_resource-based_policies_2021-10-05 Updates to single-valued and multivalued condition keys https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_single-vs-multi-valued-condition-keys.html The differences between single-valued and multivalued condition keys are now explained in more detail. The value type was added to each <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html">AWS global condition context key</a>. Thu, 30 Sep 2021 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#Updates_to_single-valued_and_multivalued_condition_keys_2021-09-30 IAM Access Analyzer supports Amazon S3 Multi-Region Access Points https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html IAM Access Analyzer identifies Amazon S3 buckets that allow public and cross-account access, including those that use Amazon S3 <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiRegionAccessPoints.html">Multi-Region Access Points</a>. Thu, 2 Sep 2021 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#IAM_Access_Analyzer_supports_Amazon_S3_Multi-Region_Access_Points_2021-09-02 AWS managed policy updates - Update to an existing policy https://docs.aws.amazon.com/IAM/latest/UserGuide/security-iam-awsmanpol.html IAM Access Analyzer updated an existing AWS managed policy. Thu, 2 Sep 2021 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#AWS_managed_policy_updates_-_Update_to_an_existing_policy_2021-09-02 More services supported for action-level policy generation https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-policy-generation.html#access-analyzer-policy-generation-cross-account IAM Access Analyzer can generate IAM policies with action-level access activity information for additional AWS services. Tue, 24 Aug 2021 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#More_services_supported_for_action-level_policy_generation_2021-08-24 Generate IAM policies for cross-account trails https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-policy-generation.html#access-analyzer-policy-generation-cross-account You can now use IAM Access Analyzer to generate fine-grained policies based on your access activity using a AWS CloudTrail trail in a different account, for example, a centralized AWS Organizations trail. Wed, 18 Aug 2021 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#Generate_IAM_policies_for_cross-account_trails_2021-08-18 Additional IAM Access Analyzer policy checks https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-reference-policy-checks.html IAM Access Analyzer extended policy validation by adding new policy checks that validate conditions included in IAM policies. These checks analyze the condition block in your policy statement and report security warnings, errors, and suggestions along with actionable recommendations. Tue, 29 Jun 2021 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#Additional_IAM_Access_Analyzer_policy_checks_2021-06-29 Action last accessed support for more services https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_access-advisor.html You can now view action last accessed information in the IAM console about the last time an IAM principal used an action for the following services: Amazon EC2, IAM, Lambda, and Amazon S3 management actions. You can also use the AWS CLI or AWS API to retrieve a data report. You can use this information to identify unnecessary permissions so that you can refine your IAM policies to better adhere to the principle of least privilege. Mon, 19 Apr 2021 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#Action_last_accessed_support_for_more_services_2021-04-19 Monitor and control actions taken with assumed roles https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html Administrators can configure IAM roles to require that identities pass a source identity, which is logged in AWS CloudTrail. Reviewing source identity information helps administrators determine who or what performed actions with assumed role sessions. Tue, 13 Apr 2021 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#Monitor_and_control_actions_taken_with_assumed_roles_2021-04-13 Generate IAM policies based on access activity https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_generate-policy.html You can now use IAM Access Analyzer to generate fine-grained policies based on your access activity found in your AWS CloudTrail. Wed, 7 Apr 2021 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#Generate_IAM_policies_based_on_access_activity_2021-04-07 IAM Access Analyzer policy checks https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-reference-policy-checks.html IAM Access Analyzer now provides over 100 policy checks with actionable recommendations during policy authoring. Tue, 16 Mar 2021 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#IAM_Access_Analyzer_policy_checks_2021-03-16 Expanded policy validation options https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_policy-validator.html Expanded policy validation available in the IAM console, AWS API, and AWS CLI using policy checks in IAM Access Analyzer to help you author secure and functional JSON policies. Mon, 15 Mar 2021 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#Expanded_policy_validation_options_2021-03-15 Tagging IAM resources https://docs.aws.amazon.com/IAM/latest/UserGuide/id_tags.html You can now tag additional IAM resources using a tag key-value pair. Thu, 11 Feb 2021 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#Tagging_IAM_resources_2021-02-11 Default password policy for IAM users https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html#default-policy-details If you do not set a custom password policy for your AWS account, IAM user passwords must now meet the default AWS password policy. Wed, 18 Nov 2020 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#Default_password_policy_for_IAM_users_2020-11-18 The actions, resources, and condition keys pages for AWS services have moved https://docs.aws.amazon.com/service-authorization/latest/reference/reference_policies_actions-resources-contextkeys.html Each AWS service can define actions, resources, and condition context keys for use in IAM policies. You can now find the list of AWS services and their actions, resources, and condition context keys in the Service Authorization Reference. Mon, 16 Nov 2020 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#The_actions,_resources,_and_condition_keys_pages_for_AWS_services_have _______________moved_2020-11-16 IAM users longer role session duration https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html IAM users can now have a longer role session duration when switching roles in the AWS Management Console, reducing interruptions due to session expiration. Users are granted the maximum session duration set for the role, or the remaining time in the IAM user's session, whichever is less. Fri, 24 Jul 2020 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#IAM_users_longer_role_session_duration_2020-07-24 Use Service Quotas to request quick increases for IAM entities https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html#reference_iam-quotas-entities You can request quota increases for adjustable IAM quotas using the Service Quotas console. Now, some increases are automatically approved in Service Quotas and available in your account within a few minutes. Larger requests are submitted to AWS Support. Thu, 25 Jun 2020 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#Use_Service_Quotas_to_request_quick_increases_for_IAM_entities_2020-06-25 Last accessed information in IAM now includes Amazon S3 management actions https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_access-advisor.html In addition to service last accessed information, you can now view information in the IAM console about the last time an IAM principal used an Amazon S3 action. You can also use the AWS CLI or AWS API to retrieve the data report. The report includes information about the allowed services and actions that principals last attempted to access and when. You can use this information to identify unnecessary permissions so that you can refine your IAM policies to better adhere to the principle of least privilege. Wed, 3 Jun 2020 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#Last_accessed_information_in_IAM_now_includes_Amazon_S3_management_actions_2020-06-03 Security chapter addition https://docs.aws.amazon.com/IAM/latest/UserGuide/security.html The security chapter helps you understand how to configure IAM and AWS STS to meet your security and compliance objectives. You also learn how to use other AWS services that help you to monitor and secure your IAM resources. Wed, 29 Apr 2020 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#Security_chapter_addition_2020-04-29 sts:RoleSessionName https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_rolesessionname You can now write a policy that grants permissions based on the session name that a principal specifies when assuming a role. Tue, 21 Apr 2020 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#sts:RoleSessionName_2020-04-21 AWS sign-in page update https://docs.aws.amazon.com/IAM/latest/UserGuide/console.html When you sign in on the main AWS sign-in page, you can no choose to sign in as the AWS account root user or an IAM user. When you do, the label on the page indicates whether you should provide your root user email address or your IAM user information. This documentation includes updated screen captures to help you understand the AWS sign-in pages. Wed, 4 Mar 2020 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#AWS_sign-in_page_update_2020-03-04 aws:ViaAWSService and aws:CalledVia condition keys https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html You can now write a policy to limit whether services can make requests on behalf of an IAM principal (user or role). When a principal makes a request to an AWS service, that service might use the principal's credentials to make subsequent requests to other services. Use the <code class="code">aws:ViaAWSService</code> condition key to match if any service makes a request using a principal's credentials. Use the <code class="code">aws:CalledVia</code> condition keys to match if specific services make a request using a principal's credentials. Thu, 20 Feb 2020 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#aws:ViaAWSService_and_aws:CalledVia_condition_keys_2020-02-20 Policy simulator adds support for permissions boundaries https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html You can now test the effect of permissions boundaries on IAM entities with the IAM policy simulator. Thu, 23 Jan 2020 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#Policy_simulator_adds_support_for_permissions_boundaries_2020-01-23 Cross-account policy evaluation https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic-cross-account.html You can now learn how AWS evaluates policies for cross-account access. This occurs when a resource in a trusting account includes a resource-based policy that allows a principal in another account to access the resource. The request must be allowed in both accounts. Thu, 2 Jan 2020 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#Cross-account_policy_evaluation_2020-01-02 Session tags https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html You can now include tags when you assume a role or federate a user in AWS STS. When you perform the <code class="code">AssumeRole</code> or <code class="code">GetFederationToken</code> operation, you can pass the session tags as attributes. When you perform the <code class="code">AssumeRoleWithSAML</code> or <code class="code">AssumeRoleWithWebIdentity</code> operations, you can pass attributes from your corporate identities to AWS. Fri, 22 Nov 2019 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#Session_tags_2019-11-22 Control access for groups of AWS accounts in AWS Organizations https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-principal-org-paths You can now reference organizational units (OUs) from AWS Organizations in IAM policies. If you use Organizations to organize your accounts into OUs, you can require that principals belong to a specific OU before granting access to your resources. Principals include AWS account root user, IAM users and IAM roles. To do this, specify the OU path in the <code class="code">aws:PrincipalOrgPaths</code> condition key in your policies. Wed, 20 Nov 2019 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#Control_access_for_groups_of_AWS_accounts_in_AWS_Organizations_2019-11-20 Role last used https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_manage_delete.html You can now view the date, time, and Region where a role was last used. This information also helps you identify unused roles in your account. You can use the AWS Management Console, AWS CLI and AWS API to view information about when a role was last used. Tue, 19 Nov 2019 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#Role_last_used_2019-11-19 Update to the global condition context keys page https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html You can now learn when each of the global condition keys is included in the context of a request. You can also navigate to each key more easily using the page table of contents (TOC). The information on the page helps you to write more accurate policies. For example, if your employees use federation with IAM roles, you should use the <code class="code">aws:userId</code> key and not the <code class="code">aws:userName</code> key. The <code class="code">aws:userName</code> key applies only to IAM users and not roles. Sun, 6 Oct 2019 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#Update_to_the_global_condition_context_keys_page_2019-10-06 ABAC in AWS https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction_attribute-based-access-control.html Learn how attribute-based access control (ABAC) works in AWS using tags, and how it compares to the traditional AWS authorization model. Use the ABAC tutorial to learn how to create and test a policy that allows IAM roles with principal tags to access resources with matching tags. This strategy allows individuals to view or edit only the AWS resources required for their jobs. Thu, 3 Oct 2019 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#ABAC_in_AWS_2019-10-03 AWS STS GetAccessKeyInfo operation https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html#Using_access-keys-audit You can review the AWS access keys in your code to determine whether the keys are from an account that you own. You can pass an access key ID using the <a href="https://docs.aws.amazon.com/cli/latest/reference/sts/get-access-key-info.html"><code class="code">aws sts get-access-key-info</code></a> AWS CLI command or the <a href="https://docs.aws.amazon.com/STS/latest/APIReference/API_GetAccessKeyInfo.html"><code class="code">GetAccessKeyInfo</code></a> AWS API operation. Wed, 24 Jul 2019 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#AWS_STS_GetAccessKeyInfo_operation_2019-07-24 Viewing Organizations service last accessed information in IAM https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_access-advisor.html You can now view service last accessed information for an AWS Organizations entity or policy in the AWS Organizations section of the IAM console. You can also use the AWS CLI or AWS API to retrieve the data report. This data includes information about the allowed services that principals in an Organizations account last attempted to access and when. You can use this information to identify unnecessary permissions so that you can refine your Organizations policies to better adhere to the principle of least privilege. Thu, 20 Jun 2019 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#Viewing_Organizations_service_last_accessed_information_in_IAM_2019-06-20 Using a managed policy as a session policy https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_assumerole.html You can now pass up to 10 managed policy ARNs when you assume a role. This allows you to limit the permissions of the role's temporary credentials. Tue, 7 May 2019 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#Using_a_managed_policy_as_a_session_policy_2019-05-07 AWS STS Region compatibility of session tokens for the global endpoint https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html You can now choose whether to use version 1 or version 2 global endpoint tokens. Version 1 tokens are valid only in AWS Regions that are available by default. These tokens will not work in manually enabled Regions, such as Asia Pacific (Hong Kong). Version 2 tokens are valid in all Regions. However, version 2 tokens are longer and might affect systems where you temporarily store tokens. Fri, 26 Apr 2019 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#AWS_STS_Region_compatibility_of_session_tokens_for_the_global_endpoint_2019-04-26 Allow enabling and disabling AWS regions https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_aws-enable-disable-regions.html You can now create a policy that allows an administrator to enable and disable the Asia Pacific (Hong Kong) Region (ap-east-1). Wed, 24 Apr 2019 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#Allow_enabling_and_disabling_AWS_regions_2019-04-24 IAM user my security credentials page https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_aws_my-sec-creds-self-manage-no-mfa.html IAM users can now manage all of their own credentials on the My Security Credentials page. This AWS Management Console page displays account information such as the account ID and canonical user ID. Users can also view and edit their own passwords, access keys, X.509 certificates, SSH keys, and Git credentials. Thu, 24 Jan 2019 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#IAM_user_my_security_credentials_page_2019-01-24 Access advisor API https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_access-advisor.html You can now use the AWS CLI and AWS API to view service last accessed information. Fri, 7 Dec 2018 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#Access_advisor_API_2018-12-07 Tagging IAM users and roles https://docs.aws.amazon.com/IAM/latest/UserGuide/id_tags.html You can now use IAM tags to add custom attributes to an identity (IAM user or role) using a tag key-value pair. You can also use tags to control an identity's access to resources or to control what tags can be attached to an identity. Wed, 14 Nov 2018 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#Tagging_IAM_users_and_roles_2018-11-14 U2F security keys https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_u2f.html You can now use U2F security keys as a multi-factor authentication (MFA) option when signing in to the AWS Management Console. Tue, 25 Sep 2018 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#U2F_security_keys_2018-09-25 Support for Amazon VPC endpoints https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_sts_vpce.html You can now establish a private connection between your VPC and AWS STS in the US West (Oregon) Region. Tue, 31 Jul 2018 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#Support_for_Amazon_VPC_endpoints_2018-07-31 Permissions boundaries https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html New feature makes it easier to grant trusted employees the ability to manage IAM permissions without also granting full IAM administrative access. Thu, 12 Jul 2018 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#Permissions_boundaries_2018-07-12 aws:PrincipalOrgID https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html New condition key provides an easier way to control access to AWS resources by specifying the AWS organization of IAM principals. Thu, 17 May 2018 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#aws:PrincipalOrgID_2018-05-17 aws:RequestedRegion https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#requested-region New condition key provides an easier way to use IAM policies to control access to AWS Regions. Wed, 25 Apr 2018 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#aws:RequestedRegion_2018-04-25 Increased session duration for IAM roles https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_manage.html An IAM role can now have a session duration of 12 hours. Wed, 28 Mar 2018 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#Increased_session_duration_for_IAM_roles_2018-03-28 Updated role-creation workflow https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create.html New workflow improves the process of creating trust relationships and attaching permissions to roles. Fri, 8 Sep 2017 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#Updated_role-creation_workflow_2017-09-08 AWS account sign-in process https://docs.aws.amazon.com/IAM/latest/UserGuide/console.html Updated AWS sign-in experience allows both the root user and IAM users to use the Sign In to the Console link on the AWS Management Console's home page. Fri, 25 Aug 2017 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#AWS_account_sign-in_process_2017-08-25 Example IAM policies https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_policy-summary-examples.html Documentation update features more than 30 example policies. Wed, 2 Aug 2017 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#Example_IAM_policies_2017-08-02 IAM best practices https://docs.aws.amazon.com/IAM/latest/UserGuide/IAMBestPracticesAndUseCases.html Information added to the Users section of the IAM console makes it easier to follow IAM best practices. Wed, 5 Jul 2017 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#IAM_best_practices_2017-07-05 Auto Scaling resources https://docs.aws.amazon.com/IAM/latest/UserGuide/list_autoscaling.html Resource-level permissions can control access to and permissions for Auto Scaling resources. Tue, 16 May 2017 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#Auto_Scaling_resources_2017-05-16 Amazon RDS for MySQL and Amazon Aurora databases https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonrds.html Database administrators can associate database users with IAM users and roles and thus manage user access to all AWS resources from a single location. Mon, 24 Apr 2017 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#Amazon_RDS_for_MySQL_and_Amazon_Aurora_databases_2017-04-24 Service-linked roles https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html Service-linked roles provide an easier and more secure way to delegate permissions to AWS services. Wed, 19 Apr 2017 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#Service-linked_roles_2017-04-19 Policy summaries https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_understand-policy-summary.html New policy summaries make it easier to understand permissions in IAM policies. Thu, 23 Mar 2017 19:00:00 GMT https://docs.aws.amazon.com/IAM/latest/UserGuide/#Policy_summaries_2017-03-23

Books

Post a Comment

نموذج الاتصال