AWS details PKI best practices for IAM Roles Anywhere integration

Amazon Web Services published best practices for integrating public key infrastructure with IAM Roles Anywhere on its security blog. The guidance outlines how organizations can securely grant temporary credentials to workloads running outside the AWS cloud. This approach reduces risks associated with long-term credential compromise by leveraging identity-based trust.

The service allows external workloads to access AWS resources using temporary security credentials from AWS Identity and Access Management. IAM Roles Anywhere relies on public key infrastructure to establish trust between AWS accounts and certificate authorities. These authorities issue digital certificates to workloads operating in on-premises or non-AWS environments. PKI manages the generation, distribution, and verification of these certificates through public key encryption.

Configuring Trust and Identity

AWS advises establishing a unique machine identity for every workload to separate access boundaries effectively. Organizations should issue separate X.509 certificates with distinct identity attributes signed by their certificate authority. This segmentation ensures that Workload A and Workload B have different permissions when accessing AWS services. The signature validation process verifies the certificate issuer and subject before issuing temporary credentials.

To enable this verification, users must set up a trust model within IAM Roles Anywhere. This involves either uploading the certificate authority’s digital certificate as a trust anchor or referencing an existing AWS Private Certificate Authority certificate. The blog post focuses on using trust anchors for this configuration. Setting up the trust model is described as a three-step process involving role creation and profile configuration.

External Workload Capabilities

As of July 2026, AWS Certificate Manager supports exportable public certificates for use on workloads outside AWS. This includes containers and on-premises systems. ACM also supports the ACME protocol for automated certificate issuance and renewal on these external workloads. These capabilities complement IAM Roles Anywhere by providing both identity and encryption for hybrid environments.

Organizations using PKI tools like Active Directory Certificate Services can centrally manage identities at scale. Workloads issuing certificates today may use them with IAM Roles Anywhere without changes. Distinct IAM roles should be configured for each workload to define the appropriate scope for temporary credentials. Workloads exchange their CA-issued X.509 certificates with IAM to obtain session credentials.

What should you do?

Review current certificate issuance processes to ensure each external workload has a unique identity. Configure trust anchors in IAM Roles Anywhere by uploading CA certificates or linking AWS Private CA. Set up distinct IAM roles with appropriate trust policies for each workload type. Monitor certificate expiration and renewal processes, especially if using ACM for automated external issuance.

What to do and how to stay safe: AWS

• Audit existing PKI tools to ensure they can issue unique X.509 certificates for each external workload.
• Configure IAM Roles Anywhere trust anchors by uploading your certificate authority’s digital certificate.
• Create separate IAM roles with specific trust policies for each workload to limit access scope.
• Verify that ACM settings support exportable certificates and ACME protocol for external hybrid environments.

Step-by-step guide: Cloud Misconfiguration Response: Containment, Recovery and Prevention Steps

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How does IAM Roles Anywhere establish trust for external workloads?

It uses public key infrastructure to verify certificates issued by trusted certificate authorities before granting temporary credentials.

When did AWS Certificate Manager begin supporting exportable public certificates?

AWS Certificate Manager began supporting exportable public certificates for external workloads as of July 2026.

Can existing certificates be used with IAM Roles Anywhere?

Yes, certificates issued to workloads today can likely be used with IAM Roles Anywhere without any changes.