Simplify cross-partition access with AWS IAM outbound identity federation

This article announces cross-partition support for AWS IAM outbound identity federation, enabling workloads to access resources across AWS partitions using short-lived JSON Web Tokens (JWTs).

• Workloads obtain signed JWTs via sts:GetWebIdentityToken in source partition and exchange them for temporary credentials via sts:AssumeRoleWithWebIdentity in destination partition
• Destination trust policies can condition on source identity context including account ID, principal ARN, source Region, and organization ID
• CloudTrail events in both partitions include matching JWT IDs for end-to-end audit trails across partition boundaries
• No long-term credentials required; all stages use temporary credentials that expire automatically
• AWS STS manages token infrastructure including issuance, signing, and key verification without requiring custom PKI
• Supports access control via IAM roles, trust policies, and new condition keys like aws:CrossPartitionSourceRegion
• Available in all AWS partitions (Commercial, China, GovCloud US, European Sovereign Cloud) at no additional cost

Cross-partition identity federation enables secure workload access across AWS partition boundaries while maintaining consistent security models and compliance audit trails.