AWS adds network restrictions for workforce identity APIs

AWS announced network access controls for IAM Identity Center's Identity Store, allowing customers to restrict requests to the APIs that manage and synchronize workforce users and groups. The capability is available in all AWS Regions where IAM Identity Center is offered. Customers can restrict Identity Store API requests to allowed private network endpoints or specific source networks. Both that API and the SCIM API, which external identity providers use to synchronize users and groups, support restrictions by IP range. Customers can set different restrictions for each API. The controls are optional, disabled by default, and exempt requests AWS services make on customers' behalf.