AWS Outlines PKI Security Standards for External Workload Identity Management

Amazon Web Services has published new best practices for integrating public key infrastructure with its IAM Roles Anywhere service. The guidance targets organizations managing workloads outside the AWS cloud that need secure access to AWS resources. By establishing proper trust models, businesses can ensure that external containers and on-premises servers authenticate correctly without relying on static credentials.

The risk

Static credentials pose a significant security risk if compromised, as they often remain valid indefinitely. AWS emphasizes that using temporary security credentials is a best practice to mitigate this exposure. IAM Roles Anywhere allows external workloads to obtain these short-lived credentials by exchanging digital certificates. This process relies on public key infrastructure to verify the identity of the workload before granting access to AWS resources, thereby reducing the blast radius of any single credential leak.

Who is exposed

Organizations running hybrid environments with multiple workloads are the primary audience for these recommendations. If a business assigns unique workload identities and specific user permissions, it can leverage PKI tools like Active Directory Certificate Services. These tools allow centralized management of identities and permissions at scale. The guidance applies to any entity issuing certificates to workloads today, as those certificates can likely be used with IAM Roles Anywhere without significant modification.

Cost and compliance

The publication notes that as of July 2026, AWS Certificate Manager supports exportable public certificates for external workloads. This feature enables automated certificate issuance and renewal via the ACME protocol. These capabilities complement IAM Roles Anywhere by providing both identity verification and encryption for hybrid environments. Organizations must configure appropriate certificate attributes and anchor their trust model around those attributes to maintain compliance with their internal security policies.

What happens next

Managers should review their current certificate issuance processes to ensure they support unique machine identities. Teams need to verify that their trust anchors are correctly configured for IAM Roles Anywhere. This involves uploading the certificate authority’s digital certificate or referencing an existing AWS Private Certificate Authority. Proper configuration ensures that signature validation processes verify the certificate issuer and subject before providing temporary credentials.

Questions to ask your suppliers

Organizations should inquire whether their vendors support automated certificate rotation for external workloads. IT leaders must determine if current certificate authorities can issue distinct X.509 certificates for each machine identity. Security teams need to verify that suppliers understand the requirements for trust anchor configuration. Operations managers should confirm that monitoring tools can track certificate expiration and usage patterns. Ensure that all stakeholders understand the separation of duties between identity management and encryption services.

What to do and how to stay safe: AWS

• Audit current certificate issuance processes to ensure unique identities for each external workload.
• Verify that trust anchors are correctly configured to validate certificate issuers and subjects.
• Implement automated renewal processes for certificates used in hybrid cloud environments.
• Review IAM roles to ensure they align with the principle of least privilege for external access.

Step-by-step guide: Implement MFA for Cloud Accounts: A Step-by-Step Rollout Plan

General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the purpose of IAM Roles Anywhere?

It allows workloads outside AWS to access AWS resources by obtaining temporary security credentials through IAM.

How does PKI integrate with this service?

PKI establishes trust between the AWS account and certificate authorities that issue certificates to external workloads.

When does ACM support exportable certificates?

As of July 2026, AWS Certificate Manager supports exportable public certificates for external workloads.