AWS vpc: Document new AWSIPAMOutboundServiceRolePolicy managed policy
Summary
Adds documentation for a new AWS managed policy, AWSIPAMOutboundServiceRolePolicy, attached to the AWSServiceRoleForIPAMOutbound service-linked role. It describes IPAM requesting an AWS web identity token (sts:GetWebIdentityToken) to federate into external providers, with the sts:IdentityTokenAudience condition key restricting token audience and denying requests without an audience. Also adds a changelog entry.
Security assessment
The change documents a new IAM managed policy and its least-privilege token-audience restriction (sts:IdentityTokenAudience) that denies requests lacking an audience, which is security-relevant guidance for federated token issuance. It is documentation of a feature, not a fix for a specific vulnerability.
Evidence
With this managed policy, IPAM requests an AWS web identity token (`sts:GetWebIdentityToken`). IPAM uses this token to federate into external providers and discover resources for your resource discovery. The `sts:IdentityTokenAudience` condition key limits each token to the external providers that IPAM supports. A request without an audience is denied.
Diff
diff --git a/vpc/latest/ipam/iam-ipam-managed-pol.md b/vpc/latest/ipam/iam-ipam-managed-pol.md index f18db01..1984167 100644 --- a//vpc/latest/ipam/iam-ipam-managed-pol.md +++ b//vpc/latest/ipam/iam-ipam-managed-pol.md @@ -7 +7 @@ -Updates to the AWS managed policy +AWS managed policy: AWSIPAMServiceRolePolicyAWS managed policy: AWSIPAMOutboundServiceRolePolicyUpdates to the AWS managed policy @@ -10,0 +11,4 @@ Updates to the AWS managed policy +IPAM uses the following AWS managed policies. You can't attach these policies to your IAM entities. Each policy is attached to an IPAM [service-linked role](./iam-ipam-slr.html) that IPAM uses to perform actions on your behalf. + +## AWS managed policy: AWSIPAMServiceRolePolicy + @@ -31,0 +36,8 @@ To view the current JSON policy document, version history, and ARN for this poli +## AWS managed policy: AWSIPAMOutboundServiceRolePolicy + +The **AWSIPAMOutboundServiceRolePolicy** managed policy is attached to the **AWSServiceRoleForIPAMOutbound** service-linked role, which IPAM uses for interacting with external providers of IPAM resources. For more information, see [Service-linked role permissions for external providers](./iam-ipam-slr.html#outbound-service-linked-role-permissions). + +With this managed policy, IPAM requests an AWS web identity token (`sts:GetWebIdentityToken`). IPAM uses this token to federate into external providers and discover resources for your resource discovery. The `sts:IdentityTokenAudience` condition key limits each token to the external providers that IPAM supports. A request without an audience is denied. + +To view the current JSON policy document, version history, and ARN for this policy, see [AWSIPAMOutboundServiceRolePolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSIPAMOutboundServiceRolePolicy.html) in the _AWS Managed Policy Reference_. + @@ -37,0 +50 @@ Change | Description | Date +AWSIPAMOutboundServiceRolePolicy – New policy | IPAM added a new AWS managed policy for the AWSServiceRoleForIPAMOutbound service-linked role. With this policy, IPAM requests AWS web identity tokens (sts:GetWebIdentityToken) to federate into external providers of IPAM resources. | October 28, 2026