AWS Sign-In Adds Support for Resource-Based Policies and Resource Control Policies
AWS has introduced support for resource-based policies and resource control policies within AWS Sign-In for the AWS Management Console. This update allows administrators to define granular access controls, such as limiting console logins exclusively to corporate network ranges or specific IP addresses. By evaluating these policies during the sign-in phase, AWS strengthens perimeter security before users can access console resources.
Related tools
Recommended tools for this topic
These picks prioritize high-intent tools relevant to this topic. Some links may include partner or affiliate tracking.
A strong security and edge platform match across CDN, Zero Trust, and app protection.
View CloudflareA high-relevance security pick for identity, secret management, and team access control.
View 1PasswordStrong for identity, OIDC, and B2B auth readers evaluating implementation tradeoffs.
View Auth0Comparison
| Aspect | Before / Alternative | After / This |
|---|---|---|
| Sign-In Network Restriction | Relied on IAM user/role policies which are evaluated after the initial sign-in session is established. | Enforced at the AWS Sign-In boundary using resource-based policies and RCPs during the authentication flow. |
| Centralized Governance | Required managing IP restrictions individually across various IAM policies and service control policies. | Managed centrally at the organization level using Resource Control Policies (RCPs) applied to AWS Sign-In. |
| Policy Target | IAM identities (users and roles) exclusively. | AWS Sign-In endpoint itself as a resource, allowing resource-based policy enforcement. |
Action Checklist
- Identify corporate network CIDR blocks and trusted IP ranges that require console access. Ensure all remote worker VPN exit points are included to prevent accidental lockouts.
- Draft the resource-based policy or Resource Control Policy targeting the AWS Sign-In service. Test the policy configuration in a non-production AWS Organization unit first.
- Apply the policies to the production AWS Sign-In configuration or organization root. Verify that authentication is blocked from non-whitelisted external networks.
Source: AWS What's New
This page summarizes the original source. Check the source for full details.
