Data protection in IAM Identity Center - Amazon IAM Identity Center
Encryption in transitData privacyData retention
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Data protection in IAM Identity Center

The Amazon Shared Responsibility Model applies to data protection in Amazon IAM Identity Center. As described in this model, Amazon is responsible for protecting the global infrastructure that runs all of the Amazon cloud. You are responsible for maintaining control over your content that is hosted on this infrastructure. You are also responsible for the security configuration and management tasks for the Amazon services that you use. For more information about data privacy, see the Data Privacy FAQ. For information about data protection in Europe, see the Amazon Shared Responsibility Model and GDPR blog post on the Amazon Security Blog.

We recommend that you secure your data in the following ways:

  • Use multi-factor authentication (MFA) with IAM Identity Center.

  • Use TLS to communicate with Amazon resources. We require TLS 1.2 and recommend TLS 1.3.

  • Set up API and user activity logging with Amazon CloudTrail. For information about using CloudTrail trails to capture Amazon activities, see Working with CloudTrail trails in the Amazon CloudTrail User Guide.

  • Use Amazon encryption solutions, along with all default security controls within Amazon services.

We strongly recommend that you never put confidential or sensitive information, such as your customers’ email addresses, into tags or free-form text fields such as a Name field. This includes when you work with Amazon IAM Identity Center, or other Amazon services using the console, API, Amazon CLI, or Amazon SDKs. Any data that you enter into tags or free-form text fields used for names may be used for diagnostic logs.

Encryption in transit

IAM Identity Center protects data in transit, as it travels to and from the service, by automatically encrypting all inter-network data using the Transport Layer Security (TLS) 1.2 or TLS 1.3 encryption protocol. Direct HTTPS requests authenticated with IAM and sent to the IAM Identity Center APIs, Identity Store API, or OIDC API, are signed using the Amazon Signature Version 4 Algorithm to establish a secure connection.

Data privacy

With IAM Identity Center, you retain control of your organization’s data. Your user and group identities stored in IAM Identity Center are shared with other Amazon services such as Amazon managed applications only if you enable them with IAM Identity Center, and if needed by those services.

For additional information, see the Amazon Data Privacy FAQ.

Data retention

IAM Identity Center stores your data such as user and group identities, and metadata, until you delete them from the service. When you delete an IAM Identity Center instance, the data it contains is also deleted.