Amazon IAM Identity Center now supports cross-Region trusted identity propagation in Amazon Web Services China Regions
Amazon IAM Identity Center trusted identity propagation now carries a user's identity across Amazon Web Services Regions, so services deployed in different Regions can authorize access based on user attributes such as group associations. Trusted identity propagation carries a user's identity with their request, so Amazon services can grant permissions based on user attributes such as group associations, and log that user's access for auditing. With cross-Region support in the Amazon Web Services China (Beijing) Region, operated by Sinnet, and the Amazon Web Services China (Ningxia) Region, operated by NWCD, this identity context can now be propagated to Amazon services running in a different Region, giving you greater flexibility in how you architect and deploy across the Amazon Web Services China Regions.
Customers often distribute workloads across Amazon Web Services Regions for many reasons, including separating compute from the data it queries, running workloads where capacity is available, or for disaster recovery and scale. Previously, trusted identity propagation required all the Amazon services accessing a user's identity to reside in the same Region. To reach services in another Region, customers had to either grant access through broad IAM roles that cannot distinguish individual users, or consolidate all their services into a single Region. With cross-Region trusted identity propagation, a user's identity travels with the request across Regions automatically, so you can grant access based on user attributes such as group associations, and audit who accessed which resources, while preserving fine-grained access control for every individual user.
Cross-Region trusted identity propagation is available at no additional cost in the Amazon Web Services China (Beijing) Region, operated by Sinnet, and the Amazon Web Services China (Ningxia) Region, operated by NWCD. It works with your existing trusted identity propagation setup, with no additional configuration. To get started, enable multi-Region replication on your Amazon IAM Identity Center instance, which requires a multi-Region customer managed KMS key. To learn more, see Trusted identity propagation in the Amazon IAM Identity Center User Guide.