AWS Security Blog
Author: Liam Wadman
Liam Wadman is a Security Solutions Architect based in Vancouver. He works with large financial institutions to create secure architectures in AWS. Liam is often found mountain biking when he is not reading IETF RFCs.
Planning for your IAM Roles Anywhere deployment
IAM Roles Anywhere is a feature of AWS Identity and Access Management (IAM) that enables you to use X.509 certificates from your public key infrastructure (PKI) to request temporary Amazon Web Services (AWS) security credentials. By using IAM Roles Anywhere, your workloads, applications, containers, or devices that run external to AWS can access AWS resources and perform tasks like […]
How to use AWS managed applications with IAM Identity Center: Enable Amazon Q without migrating existing IAM federation flows
June 9, 2025: We added a section on how to use a service control policy to block permission sets from being used in your organization’s member accounts. AWS IAM Identity Center is the preferred way to provide workforce access to Amazon Web Services (AWS) accounts, and enables you to provide workforce access to many AWS […]
How to use the PassRole permission with IAM roles
iam:PassRole is an AWS Identity and Access Management (IAM) permission that allows an IAM principal to delegate or pass permissions to an AWS service by configuring a resource such as an Amazon Elastic Compute Cloud (Amazon EC2) instance or AWS Lambda function with an IAM role. The service then uses that role to interact with […]
How to use policies to restrict where EC2 instance credentials can be used from
January 13, 2025: This post was updated to state the limitations of AWS service permissions with VPC endpoints. April 5, 2023: A fix has been added to the Service Control Policy examples to allow EC2 instances to mount encrypted EBS volumes. March 7, 2023: We’ve added language clarifying the requirement around using VPC Endpoints, and […]
You can now assign multiple MFA devices in IAM
November 17, 2025: The MFA Security Key program, which provided eligible customers with free MFA devices, has been discontinued effective November 6th, 2025. While existing devices will continue to function normally, no new orders for MFA security keys will be accepted after the program closure date. At Amazon Web Services (AWS), security is our top […]