AWS IAM Identity Center now supports optimistic locking for users and groups in its identity store

IAM Identity Center Updates

IAM Identity Center now supports optimistic locking for users and groups in the identity store, ensuring that update and delete requests succeed only if the user or group hasn't changed since it was last read. This feature helps prevent conflicts when multiple administrators or automated workflows modify the same user or group simultaneously.

Each user and group has a Revision value that changes with every modification. Operations like Create, Describe, Update, and List return the current Revision, which can be passed in subsequent UpdateUser, UpdateGroup, DeleteUser, or DeleteGroup requests. The request will only succeed if the supplied Revision matches the current one. If not, a ConflictException is returned, allowing your workflow to re-read the user or group and retry with the latest values.

What to do

• Use the Revision value in your workflows to prevent conflicts.
• Pass the Revision value in UpdateUser, UpdateGroup, DeleteUser, or DeleteGroup requests.
• Handle ConflictException by re-reading the user or group and retrying.

Providing a Revision is optional; requests that omit it will behave as before. This capability is available in all AWS Regions where IAM Identity Center is available. IAM Identity Center is provided at no additional cost.

Source: AWS release notes

If you need further guidance on AWS, our experts are available at AWS@westloop.io. You may also reach us by submitting the Contact Us form.