Managing hybrid workloads with IAM Roles Anywhere, featuring
summary
IAM Roles Anywhere issues temporary AWS credentials to off‑AWS workloads using X.509 and a trust anchor tied to an AWS Private CA, validated via CreateSession and the credential helper (v1.03) that auto‑renews one‑hour tokens today and will support up to 12 hours. Hertz replaces static keys across ~400 accounts, implements a three‑tier PKI with daily CRL uploads, automates certificate issuance with Jenkins + CloudFormation, and logs activity to CloudTrail/CloudWatch for expiry and session auditing while the Salesforce→DynamoDB connector moves from long‑lived users to role‑based access.
AI-written summary · about
chapters (13)
- 0:00Intro
- 2:37Introducing IAM Roles Anywhere
- 3:24How IAM Roles Anywhere works on AWS
- 6:52Workload identities
- 10:29Assume role policy document
- 15:12Hertz AWS footprint
- 19:20How Hertz addressed their workload challenge
- 21:14CA hierarchy design
- 22:46AWS ACM configuration: Private CA hierarchy
- 27:13PCA certificate issuing
- 32:12IAM Roles Anywhere: Profile session policy and role trust relationships
- 34:00IAM Roles Anywhere: Hertz future state
- 39:39Looking ahead: Capabilities
related talks
28mYour journey to temporary credentials in the cloud
29mWorkload Identity for Humans: A Twelve-Factor Approach
01h 00mAWS Identity Workshop
30mHashiCorp Vault and Jenkins - Leveraging AWS IAM to Empower a Hybrid Scenario
35mSecure Remote Access for Hybrid Workforce on AWS
21mAutomating Secure OIDC-Based Cross-Cloud Authentication
25mHow to Kill an AWS Access Key
20mSecuring workloads using data protection services