IAM Roles Anywhere now supports post-quantum digital certificates

AWS IAM Roles Anywhere Now Supports FIPS 204 ML-DSA

AWS Identity and Access Management (IAM) Roles Anywhere now supports the FIPS 204 Module-Lattice Digital Signature Standard (ML-DSA), a quantum-resistant digital signature algorithm standardized by NIST to protect against quantum computing threats. This feature is particularly useful for customers authenticating workloads using X.509 certificates issued by certificate authorities.

IAM Roles Anywhere allows workloads outside of AWS to obtain temporary AWS credentials using X.509 certificates to access AWS resources. You can now use ML-DSA-signed CA certificates as IAM Roles Anywhere trust anchors and issue end entity certificates bound to ML-DSA keys.

What to do

• Create a trust anchor using ML-DSA-signed CA certificates.
• Issue end entity certificates bound to ML-DSA keys.
• Establish trust between your AWS environment and your PKI.

This feature is available in all AWS Regions where IAM Roles Anywhere is available. To learn more, see the IAM Roles Anywhere User Guide.

Source: AWS release notes

If you need further guidance on AWS, our experts are available at AWS@westloop.io. You may also reach us by submitting the Contact Us form.