AWS IAM
The Identity and Access Management service provided by Amazon Web Services, supporting fine-grained permission policy configuration including organization-level access controls such as Service Control Policies.
Timeline (last 90 days)
Calling Amazon Bedrock requires the IAM permission bedrock:InvokeModel, and each model must be explicitly requested for activation in the target region.
Failures at the deployment stage usually come from insufficient IAM permissions or the model not being enabled in the target region, with direct error messages and fast localization; runtime failures, by contrast, often stem from a certain account simply not having accepted the MPPO, in which case application calls to Bedrock receive authorization-type errors, but the error message does not necessarily point directly to the missing Marketplace entitlement.
On the AWS side, JalOS uses EC2 for hosting, IAM for access control, Systems Manager Parameter Store for configuration management, S3 for storing deployment artifacts and model files, CloudWatch for log collection, and Systems Manager Run Command for executing deployments.
By combining AWS IAM's Service Control Policies (SCP), platform teams can set maximum permission boundaries at the organizational layer such that even project-layer administrators cannot break through the compliance constraints set at the organizational layer.
Hosting the MCP server on AgentCore allows reuse of its deep integration with AWS IAM, enabling secure access to target production accounts via cross-account IAM role trust relationships and avoiding the risk of hardcoded credentials.
For workloads running on AWS (M2M scenarios), it is recommended to use cross-account SigV4 signing combined with cross-account role assumption for authentication.
Cross-account role assumption obtains temporary credentials for a target account's IAM role by calling STS's AssumeRole API, with temporary credentials typically valid for 15 minutes to 1 hour.
AWS IAM and OAuth 2.0's delegated authorization flows are typical implementations of identity and access management.
The concept of declarative policies has been widely adopted in the infrastructure domain (e.g., AWS IAM policies, Kubernetes RBAC), but remains in an early stage at the AI agent layer.
IAM, represented by AWS IAM, follows the principle of least privilege, where each principal is granted only the minimum set of permissions required to complete a specific task.
6 more timeline events
All Facts (18)
Claude Platform on AWS直接支持AWS IAM原生认证机制，企业可以沿用已有的权限管理体系来控制Claude API的访问权限
95%Unverified该客户端支持全局快捷键唤起、AWS IAM认证集成和macOS钥匙串安全集成
85%UnverifiedIAM, represented by AWS IAM, follows the principle of least privilege, where each principal is granted only the minimum set of permissions required to complete a specific task.
60%UnverifiedCalling Amazon Bedrock requires the IAM permission bedrock:InvokeModel, and each model must be explicitly requested for activation in the target region.
50%UnverifiedFailures at the deployment stage usually come from insufficient IAM permissions or the model not being enabled in the target region, with direct error messages and fast localization; runtime failures, by contrast, often stem from a certain account simply not having accepted the MPPO, in which case application calls to Bedrock receive authorization-type errors, but the error message does not necessarily point directly to the missing Marketplace entitlement.
50%UnverifiedOn the AWS side, JalOS uses EC2 for hosting, IAM for access control, Systems Manager Parameter Store for configuration management, S3 for storing deployment artifacts and model files, CloudWatch for log collection, and Systems Manager Run Command for executing deployments.
50%UnverifiedBy combining AWS IAM's Service Control Policies (SCP), platform teams can set maximum permission boundaries at the organizational layer such that even project-layer administrators cannot break through the compliance constraints set at the organizational layer.
50%UnverifiedHosting the MCP server on AgentCore allows reuse of its deep integration with AWS IAM, enabling secure access to target production accounts via cross-account IAM role trust relationships and avoiding the risk of hardcoded credentials.
50%UnverifiedFor workloads running on AWS (M2M scenarios), it is recommended to use cross-account SigV4 signing combined with cross-account role assumption for authentication.
50%UnverifiedCross-account role assumption obtains temporary credentials for a target account's IAM role by calling STS's AssumeRole API, with temporary credentials typically valid for 15 minutes to 1 hour.
50%UnverifiedAWS IAM and OAuth 2.0's delegated authorization flows are typical implementations of identity and access management.
50%UnverifiedThe concept of declarative policies has been widely adopted in the infrastructure domain (e.g., AWS IAM policies, Kubernetes RBAC), but remains in an early stage at the AI agent layer.
50%UnverifiedKey rotation refers to periodically replacing access credentials to reduce the risk of long-term credential exposure, and tools such as AWS IAM and HashiCorp Vault have standardized this practice.
50%UnverifiedCognito's User Pool handles authentication functions such as user registration, login, and password management, while the Identity Pool is responsible for mapping authenticated users to AWS IAM temporary credentials.
50%UnverifiedThe Condition field in an AWS IAM role trust policy uses StringEquals or StringLike operators to match claims in the JWT, which is the core of the security boundary.
50%UnverifiedWhen using StringLike with a wildcard such as repo:my-org/my-repo*, an attacker could create a repository named my-org/my-repo-malicious to satisfy the condition.
50%UnverifiedUnity Catalog implements Attribute-Based Access Control (ABAC) and row-level/column-level security policies, supporting deep integration with cloud provider IAMs such as AWS IAM and Azure AD.
50%UnverifiedAWS IAM best practices recommend rotating access keys every 90 days
50%