AWS put a network perimeter around the Identity Store

2026-10-07

IAM Identity Center's Identity Store, the directory behind your workforce SSO, now supports network access controls. You can restrict the Identity Store API to VPC endpoints or specific VPCs, and restrict both the Identity Store API and the SCIM API to specific IP ranges. Off by default. Configured through the Identity Store API (SDKs or CLI) only, no console toggle.

What was announced

• The Identity Store holds every user and group in IAM Identity Center.
• Two APIs touch it: the Identity Store API (your applications and provisioning workflows use it to manage and look up users and groups) and the SCIM API (your external identity provider uses it to sync users and groups).
• You can apply different network restrictions to each API in one configuration. The example from the announcement: require Identity Store API traffic to arrive only through VPC endpoints, while SCIM accepts only your identity provider's published IP ranges.
• For the Identity Store API specifically, you can require requests to come through allowed VPC endpoints in your account or organization, or from specific source VPCs.
• Requests that AWS services make on your behalf are exempt.
• Available in all regions where IAM Identity Center is offered.
• Under the hood it is a NetworkConfiguration on UpdateIdentityStore, and DescribeIdentityStore reads it back.

Source: AWS What's New. API details: NetworkConfiguration and UpdateIdentityStore in the Identity Store API reference. Related: AWS Security Blog on sign-in policies and RCPs.

Why it matters

The SCIM endpoint is the interesting one. It is the inbound provisioning path from your identity provider, and it being wide open always felt sketchy even with auth. Pinning it to your IdP's published IP ranges is defense in depth where it actually matters: the directory everything else trusts.

People harden the SSO portal and forget the directory has an API at all. This closes that layer. It also continues a pattern. In June 2026, AWS added resource-based policies and resource control policies for AWS Sign-in, so console and aws login sessions can be limited to expected networks. Those pair with Management Console Private Access, which has been around since 2023. The directory was the remaining gap.

The catch: off by default

Nothing changes until someone turns it on, per API, through the API. If you run Identity Center, the new audit question is: are network controls enabled on the identity store, and are the SCIM ranges pinned to our IdP?

Watch the update semantics. When you send a network configuration, it replaces the current one, and anything you leave out is cleared. To add one IP range, you resend the full set. The VPC endpoint flag has to be set explicitly, true or false, every time.

There is no console switch, so this belongs in infrastructure as code, not a runbook step someone remembers once. As of this writing I couldn't find a resource for it in the Terraform AWS provider, so until one lands it means a scripted update-identity-store call in your pipeline, with describe-identity-store as a drift check. Put it next to your Identity Center configuration.

Is anyone talking about it

Not really. As of October 8, the announcement has been picked up by AWS news digests and aggregators, but I found no press coverage or community analysis. Quiet launch. That usually means the people who need it discover it during an audit, which is a fine reason to be early.