|
Immediately, we’re saying the final availability of AWS IAM Identification Heart multi-Area help to allow AWS account entry and managed software use in extra AWS Areas.
With this characteristic, you may replicate your workforce identities, permission units, and different metadata in your group occasion of IAM Identification Heart linked to an exterior identification supplier (IdP), corresponding to Microsoft Entra ID and Okta, from its present major Area to extra Areas for improved resiliency of AWS account entry.
You too can deploy AWS managed functions in your most popular Areas, near software customers and datasets for improved person expertise or to satisfy knowledge residency necessities. Your functions deployed in extra Areas entry replicated workforce identities regionally for optimum efficiency and reliability.
If you replicate your workforce identities to an extra Area, your workforce will get an energetic AWS entry portal endpoint in that Area. Which means within the unlikely occasion of an IAM Identification Heart service disruption in its major Area, your workforce can nonetheless entry their AWS accounts via the AWS entry portal in an extra Area utilizing already provisioned permissions. You possibly can proceed to handle IAM Identification Heart configurations from the first Area, sustaining centralized management.
Allow IAM Identification Heart in a number of Areas
To get began, it’s best to verify that the AWS managed functions you’re presently utilizing help buyer managed AWS Key Administration Service (AWS KMS) key enabled in AWS Identification Heart. After we launched this characteristic in October 2025, Seb advisable utilizing multi-Area AWS KMS keys except your organization insurance policies limit you to single-Area keys. Multi-Area keys present constant key materials throughout Areas whereas sustaining impartial key infrastructure in every Area.
Earlier than replicating IAM Identification Heart to an extra Area, it’s essential to first replicate the shopper managed AWS KMS key to that Area and configure the duplicate key with the permissions required for IAM Identification Heart operations. For directions on creating multi-Area duplicate keys, check with Create multi-Area duplicate keys within the AWS KMS Developer Information.
Go to the IAM Identification Heart console within the major Area, for instance, US East (N. Virginia), select Settings within the left-navigation pane, and choose the Administration tab. Verify that your configured encryption secret is a multi-Area buyer managed AWS KMS key. So as to add extra Areas, select Add Area.
You possibly can select extra Areas to duplicate the IAM Identification Heart in an inventory of the out there Areas. When selecting an extra Area, take into account your supposed use instances, for instance, knowledge compliance or person expertise.
If you wish to run AWS managed functions that entry datasets restricted to a selected Area for compliance causes, select the Area the place the datasets reside. In the event you plan to make use of the extra Area to deploy AWS functions, confirm that the required functions help your chosen Area and deployment in extra Areas.
Select Add Area. This begins the preliminary replication whose period is dependent upon the scale of your Identification Heart occasion.
After the replication is accomplished, your customers can entry their AWS accounts and functions on this new Area. If you select View ACS URLs, you may view SAML info, corresponding to an Assertion Client Service (ACS) URL, in regards to the major and extra Areas.
How your workforce can use an extra Area
AWS Identification Heart helps SAML single sign-on with exterior IdPs, corresponding to Microsoft Entra ID and Okta. Upon authentication within the IdP, the person is redirected to the AWS entry portal. To allow the person to be redirected to the AWS entry portal within the newly added Area, you might want to add the extra Area’s ACS URL to the IdP configuration.
The next screenshots present you the way to do that within the Okta admin console:
Then, you may create a bookmark software in your identification supplier for customers to find the extra Area. This bookmark app features like a browser bookmark and accommodates solely the URL to the AWS entry portal within the extra Area.
You too can deploy AWS managed functions in extra Areas utilizing your current deployment workflows. Your customers can entry functions or accounts utilizing the prevailing entry strategies, such because the AWS entry portal, an software hyperlink, or via the AWS Command Line Interface (AWS CLI).
To study extra about which AWS managed functions help deployment in extra Areas, go to the IAM Identification Heart Consumer Information.
Issues to know
Listed below are key concerns to find out about this characteristic:
- Consideration – To benefit from this characteristic at launch, you should be utilizing a corporation occasion of IAM Identification Heart linked to an exterior IdP. Additionally, the first and extra Areas should be enabled by default in an AWS account. Account cases of IAM Identification Heart, and the opposite two identification sources (Microsoft Lively Listing and IAM Identification Heart listing) are presently not supported.
- Operation – The first Area stays the central place for managing workforce identities, account entry permissions, exterior IdP, and different configurations. You should use the IAM Identification Heart console in extra Areas with a restricted characteristic set. Most operations are read-only, apart from software administration and person session revocation.
- Monitoring – All workforce actions are emitted in AWS CloudTrail within the Area the place the motion was carried out. This characteristic enhances account entry continuity. You possibly can arrange break-glass entry for privileged customers to entry AWS if the exterior IdP has a service disruption.
Now out there
AWS IAM Identification Heart multi-Area help is now out there within the 17 enabled-by-default business AWS Areas. For Regional availability and a future roadmap, go to the AWS Capabilities by Area. You should use this characteristic at no extra price. Normal AWS KMS fees apply for storing and utilizing buyer managed keys.
Give it a attempt within the AWS Identification Heart console. To study extra, go to the IAM Identification Heart Consumer Information and ship suggestions to AWS re:Publish for Identification Heart or via your traditional AWS Help contacts.
— Channy
Up to date on February fifth — Fastened the Okta admin console screenshot.
