When your workloads run across AWS partitions such as Commercial, China, GovCloud (US), and European Sovereign Cloud, a workload in one partition might need to access resources or communicate with AWS services in another partition. AWS partitions are hard isolation boundaries with independent instances of AWS Identity and Access Management (IAM), so a credential issued in one partition isn’t valid in another.
As a result, direct role assumption with sts:AssumeRole doesn’t work across partition boundaries and resource policies can’t reference principals that exist in another partition. AWS IAM outbound identity federation already lets your workloads obtain a short-lived, AWS signed JSON Web Token (JWT) and use it to authenticate to external services. Today, we’re extending it with cross-partition support.
