AWS IAM launches aws:SourceVpcArn condition key for region-based access control

AWS IAM Global Condition Key Update

AWS Identity and Access Management (IAM) now supports a new global condition key, aws:SourceVpcArn, enabling customers to enforce region-based access controls for resources accessed through AWS PrivateLink. This condition key returns the ARN of the VPC where the VPC endpoint is attached, allowing customers to verify whether requests travel through a specific VPC and implement controls on private access to their resources in same-region or cross-region scenarios.

Customers can use aws:SourceVpcArn in policies to ensure resources are only accessible from VPC endpoints in specific regions, helping enforce data residency requirements. For example, you can attach a policy to an Amazon S3 bucket that restricts access to requests made through VPC endpoints in designated regions only.

What to do

• Update IAM policies to include the aws:SourceVpcArn condition key for resources accessed through AWS PrivateLink.
• Verify that your policies correctly enforce region-based access controls.
• Refer to the IAM User Guide for more information.

Source: AWS release notes

If you need further guidance on AWS, our experts are available at AWS@westloop.io. You may also reach us by submitting the Contact Us form.