IAM Roles Anywhere now supports automatic certificate revocation checking

AWS IAM Roles Anywhere

AWS IAM Roles Anywhere now supports automatic revocation checking using certificate revocation list (CRL) distribution points (CDPs). This feature helps keep revocation checks in sync with your certificate authority (CA) and improves your security posture by denying credential requests that use revoked certificates.

Previously, you had to manually import CRLs into IAM Roles Anywhere and re-import them each time your CA published an update. Now, IAM Roles Anywhere automatically downloads CRLs from your CDPs and refreshes them periodically.

What to do

• Enable automatic revocation checking on a trust anchor using the IAM Roles Anywhere console, AWS SDKs, or AWS CLI.
• Ensure your certificates include publicly accessible CDP URLs that meet the distribution point requirements.

This feature is available at no additional cost in all commercial AWS Regions. To learn more, see Automatic revocation checking with CRL distribution points in the IAM Roles Anywhere User Guide.

If you need further guidance on AWS, our experts are available at AWS@westloop.io. You may also reach us by submitting the Contact Us form.