A credential on each side
AWS extended its identity federation service on November 9 so that software running in one AWS partition can obtain temporary credentials in another. A partition has its own identity system. Previously, a role in GovCloud could not simply assume a commercial AWS role using its existing credentials. The new arrangement lets the destination account recognize a signed assertion about the originating workload and decide what access to grant. Customers must enable the feature and configure that trust.
Tracing a government workload
AWS illustrates the change with a GovCloud workload accessing a commercial storage bucket. An investigator looking at the commercial account can see the originating principal and region. A token identifier connects the destination event to the record of issuance in the source account. That gives a government contractor investigating a storage access two independently recorded points to reconcile. The role still determines what the workload can do after it arrives.
Where the authorization decision sits
The example also exposes a distinction for government buyers assessing a proposed architecture. They can ask an operator to show which workload was admitted, what the role permitted and what data movement the contract allows. The first two questions have answers in the identity configuration and logs. The third depends on the data and the agreement. AWS itself directs customers to review their compliance obligations when deciding whether to authorize a crossing.
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
