Aidan Steele's blog (usually about AWS)

AWS just [announced][announcement] that S3 event notifications now include the system-generated tags attached to the bucket responsible for the notification.

AssumeRoleWithWebIdentity seems to have a new, barely-documented, policy condition key.

Earlier today, AWS IAM Identity Center [launched][launch] the ability for server-side applications to assume roles on behalf of their users.

AWS launched Lambda MicroVMs [earlier today][launch].

Amazon has deprecated CloudTrail Lake as of 1st June 2026 for new customers.

I was looking at the execution history for a Step Functions state machine that is triggered daily by an EventBridge Scheduler schedule.

AWS principal tags are useful for fine-grained access control.

Athena is one of my favourite AWS services.

Lately, I've been interested in how third party vendors can best authenticate into their customers' cloud accounts.

Back in November last year, I [wished][prev-blog] for the ability to filter CloudTrail data events by the requesting principal's ARN.

There are several ways that CloudFront can be configured with an S3 origin.

UPDATE: My dream came true - almost.

Credentials for AWS IAM role sessions are short-lived.

tl;dr: Search CloudTrail for instances of AssumeRole with additionalEventData.explicitTrustGrant == false.

AWS CloudShell got a [new capability][whats-new] in January 2024: running Docker containers.

This article has been in my drafts for 380 days.

The short version: AWS IAM Identity Center exchanges third-party OIDC tokens for Identity Center-issued tokens.

A few years ago, I [wrote][akia-blog] about determining AWS account IDs from AWS access keys, i.e. those strings that begin with AKIA or ASIA.

Back in 2021, I [requested][my-blog] that AWS add some kind of "claim-to-tag mapping" functionality to OIDC IDPs, so that we could have role session tags based on claims in OIDC tokens issued by GitHub Actions.