AWS Identity and Access Management (IAM) now supports a new global condition key, aws:SourceVpcArn, that enables customers to enforce region-based access controls for resources accessed through AWS PrivateLink. This condition key returns the ARN of the VPC where the VPC endpoint is attached, allowing customers to verify whether requests travel through a specific VPC and implement controls on private access to their resources in same-region or cross-region scenarios.
Customers can use aws:SourceVpcArn in policies to ensure resources are only accessible from VPC endpoints in specific regions, helping enforce data residency requirements. For example, you can attach a policy to an Amazon S3 bucket that restricts access to requests made through VPC endpoints in designated regions only.
The aws:SourceVpcArn condition key is available in all commercial AWS Regions. For a complete list of supported AWS services and to learn more, please refer to the IAM User Guide.
Categories: general:products/aws-iam,marketing:marchitecture/management-tools
Source: Amazon Web Services
Latest Posts
- Amazon Braket now in scope for FedRAMP Class C
- Workers, Cloudflare CLI – Test Cron Triggers with Local Explorer
- MC1191578: Exchange Online Pauses EWS Access Block for Kiosk and Frontline Worker Licenses
- Amazon CloudWatch log centralization now available in AWS GovCloud and additional commercial Regions
