AWS IAM Identity Center now supports multi-Region replication for AWS account access and application use | Amazon Web Services (opens in new tab)
AWS IAM Identity Center now supports multi-Region replication for organizations using an external identity provider such as Microsoft Entra ID or Okta. Workforce identities, permission sets, and related metadata can be replicated from a primary Region, allowing users to access AWS accounts and managed applications if the primary service is disrupted. The feature also supports regional application deployment for improved performance and data residency compliance, with centralized configuration remaining in the primary Region. ## Multi-Region Replication and Resilience - Replication provides an active AWS access portal endpoint in each additional Region. - Users can continue accessing AWS accounts with already-provisioned permissions during a primary-Region disruption. - AWS managed applications can access replicated identities locally, improving reliability and proximity to users or datasets. - IAM Identity Center configuration remains centrally managed from the primary Region. ## Prerequisites and Setup - The feature requires: - An organization instance of IAM Identity Center. - An external IdP, such as Okta or Microsoft Entra ID. - Primary and additional Regions that are enabled by default. - Before replication, the customer-managed AWS KMS key must be replicated to the target Region. - AWS recommends multi-Region KMS keys because they maintain consistent key material across Regions while preserving independent regional infrastructure. - In the IAM Identity Center console, administrators select **Settings → Management → Add Region** and choose the target Region. - Initial replication time depends on the size of the Identity Center instance. ## User Authentication and Access - Administrators must add the additional Region’s SAML Assertion Consumer Service (ACS) URL to the external IdP configuration. - A bookmark application can be created in the IdP to provide users with direct access to the new Region’s AWS access portal. - Users can access accounts and applications through existing methods, including: - The AWS access portal - Application links - The AWS CLI ## Regional Application Deployment - AWS managed applications can be deployed in additional Regions using existing deployment workflows. - Organizations can place applications near regional datasets to satisfy performance or data residency requirements. - Administrators should verify that each required managed application supports both the selected Region and multi-Region deployment. ## Operational Considerations - Additional Regions provide a limited-management console experience. - Most operations outside the primary Region are read-only, except application management and user session revocation. - Workforce activity is recorded in AWS CloudTrail in the Region where it occurs. - Break-glass access is recommended for privileged users if the external IdP becomes unavailable. - Account instances, Microsoft Active Directory identity sources, and the built-in IAM Identity Center directory are not supported at launch. ## Availability and Cost - The feature is available at no additional IAM Identity Center cost in 17 enabled-by-default commercial AWS Regions. - Standard AWS KMS charges apply for customer-managed key storage and use. Organizations using supported external IdPs should replicate IAM Identity Center into strategically selected Regions, configure the required KMS replicas and ACS URLs, and test regional access and emergency procedures before relying on the setup for disaster recovery.