AWS Sign-In Adds Support for Resource-Based Policies and Resource Control Policies
AWS Sign-In now supports resource-based policies and resource control policies, enabling organizations to restrict AWS Management Console access to trusted networks.
AWS has introduced support for resource-based policies and resource control policies within AWS Sign-In for the AWS Management Console. This update allows administrators to define granular access controls, such as limiting console logins exclusively to corporate network ranges or specific IP addresses. By evaluating these policies during the sign-in phase, AWS strengthens perimeter security before users can access console resources.
Primary source
Open AWS What's New ↗This article summarizes the source. Check the original for full details and conditions.
Comparison
| Aspect | Before / Alternative | After / This |
|---|---|---|
| Sign-In Network Restriction | Relied on IAM user/role policies which are evaluated after the initial sign-in session is established. | Enforced at the AWS Sign-In boundary using resource-based policies and RCPs during the authentication flow. |
| Centralized Governance | Required managing IP restrictions individually across various IAM policies and service control policies. | Managed centrally at the organization level using Resource Control Policies (RCPs) applied to AWS Sign-In. |
| Policy Target | IAM identities (users and roles) exclusively. | AWS Sign-In endpoint itself as a resource, allowing resource-based policy enforcement. |
Action Checklist
- Identify corporate network CIDR blocks and trusted IP ranges that require console access. Ensure all remote worker VPN exit points are included to prevent accidental lockouts.
- Draft the resource-based policy or Resource Control Policy targeting the AWS Sign-In service. Test the policy configuration in a non-production AWS Organization unit first.
- Apply the policies to the production AWS Sign-In configuration or organization root. Verify that authentication is blocked from non-whitelisted external networks.