Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Feature Request: Conditional Access for IAM Identity Center or CodeCatalyst Space

0

Our company is evaluating AWS and plans to use CodeCatalyst as the central DevOps tool. However, we found that IAM Identity Center does not support Conditional Access (e.g., restrict login by corporate/VPN IP ranges). This creates security risks, since developers could log in from untrusted networks (home, cafés) and potentially download source code.

Many IdPs (Microsoft Entra ID, Okta) already support Conditional Access. For AWS-native customers, it would be very valuable if either: 1. IAM Identity Center provides Conditional Access (IP/VPN based sign-in restrictions), or 2. CodeCatalyst supports Space-level access policies (limit access by IP/VPN).

Even one of these options would make it much easier for enterprises to adopt AWS CodeCatalyst securely as their DevOps platform.

Topics
DevOpsDeveloper ToolsSecurity, Identity, & Compliance
Tags
AWS IAM Identity CenterSecurity, Identity, & ComplianceAmazon CodeCatalyst
Language
English

asked a year ago272 views

2 Answers
6

Consider below workarounds:

  • Federate IAM Identity Center with Entra ID or Okta: This allows you to enforce Conditional Access before users reach AWS.
  • Use VPC endpoints for service access: While not a full solution, it helps contain traffic within trusted networks.
  • Custom IAM policies with aws:SourceIp: You can restrict access to certain AWS resources based on IP, but this doesn't apply to IAM Identity Center or CodeCatalyst UI.
EXPERT

answered a year ago

0

Hey,

Hope you're keeping well.

Currently IAM Identity Center doesn’t have native conditional access or IP-based login restrictions, and CodeCatalyst Spaces also don’t support IP allowlists. The most practical AWS-native workaround is to federate IAM Identity Center with an external IdP like Entra ID or Okta, where you can enforce Conditional Access policies before authentication reaches AWS. For resource-level control, you can use IAM policy conditions such as aws:SourceIp to restrict API access from specific networks, although this won’t block console or CodeCatalyst UI access directly.

Thanks and regards,
Taz

answered 8 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content