AWS adds private access to identity verification endpoints

AWS says workloads in restricted virtual private clouds can now retrieve identity verification metadata and public keys through private network endpoints. Previously, those discovery endpoints were reachable only over the public internet, preventing workloads without internet access from retrieving the information needed to verify short-lived identity tokens. The change extends AWS IAM outbound identity federation, which lets workloads use short-lived tokens when accessing external services instead of keeping long-lived credentials. AWS PrivateLink carries requests to the discovery endpoints within the AWS network. The feature is available in commercial, GovCloud and China Regions, with standard PrivateLink pricing.