AWS Identity and Access Management (IAM) Roles Anywhere enhanced security by applying VPC endpoint policies to the CreateSession API, which issues temporary AWS credentials to external workloads authenticated with X.509 certificates. This change ensures that if the CreateSession operation is not explicitly permitted in the VPC endpoint policy, credential requests are denied, aligning this operation’s access control with other IAM Roles Anywhere APIs.
Previously, VPC endpoint policies did not govern CreateSession operations, leaving a security gap. Now, administrators can enforce consistent and granular controls across all IAM Roles Anywhere API calls. This feature is deployed globally in all supported AWS Regions, including GovCloud and sovereign regions, enhancing enterprise security posture for hybrid and external workloads utilizing AWS credentials.
Source & further reading
IAM Roles Anywhere now enforces VPC endpoint policies for the CreateSession API ↗Source published 2026-05-01. This report was prepared with AI assistance from the linked primary-source material. Claims and limitations should be checked against the original announcement or research.