AWS Identity Store network controls: IP exceptions and SCIM checks

Identify the request path you need to restrict

These controls govern network access to an identity store. Teams administering that store need to check Identity Store API traffic and SCIM provisioning separately. This is not a regional account sign-in restriction, and it does not replace the caller's identity or permission checks.

AWS says the feature is available wherever IAM Identity Center is offered, with controls off by default. Requests AWS services make on a customer's behalf are exempt. This article has not verified every Region, instance type, or external identity provider individually.

The API IP list creates exceptions to VPC restrictions

VpceAccessRequired=true requires a VPC endpoint. A VPC is a virtual private network in AWS; an endpoint provides access to the relevant service. ApiRestrictSourceVpcs can additionally specify which source VPCs may call Identity Store APIs. Omitting that list removes the specific-VPC restriction while retaining any endpoint requirement.

ApiAllowSourceIps works differently: a matching API source bypasses both restrictions. CIDR represents an address range using an address and prefix length. If you intend private-endpoint-only access, review whether IP exceptions are needed and how broad they are. The three fields are not conditions every request must satisfy together.

Check your identity provider's SCIM sources separately

ScimAllowSourceIps rejects SCIM requests from outside its ranges. If omitted, SCIM remains subject to other network controls, including an enabled endpoint requirement. A successful API call from your own environment therefore does not prove external provisioning works.

AWS uses 0.0.0.0/0 to illustrate public IPv4 SCIM access alongside API endpoint restrictions. That illustrates behavior; it is not a recommended configuration for every team. Confirm your identity provider's actual provisioning sources and change arrangements before selecting ranges. This article establishes no provider's fixed egress addresses.

Each IP list and the source-VPC list supports at most 50 entries. The IP field model accepts IPv4 and IPv6 ranges. An IPv4 allowance does not automatically cover IPv6, so check the actual sources.

Save the existing configuration before replacing it

Confirm the Identity Store ID or ARN, Region, and the caller's authorization. Read NetworkConfiguration with DescribeIdentityStore and retain the complete original values. This article provides no universal IAM policy; verify authorization against your resources and AWS permission documentation.

Build the complete desired NetworkConfiguration for UpdateIdentityStore, including settings you want to keep. Omitted values are cleared. To clear a list, omit it; an empty array is invalid. Supplying one new CIDR does not append it to the old list.

Whenever you supply NetworkConfiguration, explicitly set VpceAccessRequired to true or false. For example, adding a provisioning source still requires reading the old values and constructing the complete intended object. This hypothetical example explains the update model, not a ready-to-apply policy.

Read back the settings, then verify both paths

Submit the reviewed configuration with AWS CLI identitystore update-identity-store or the SDK equivalent. Use DescribeIdentityStore to compare every resulting field. An ID or ARN in the update response does not validate the network paths.

In an authorized, controlled environment, check an intended allowed API source, an intended denied source, and actual identity-provider SCIM provisioning separately. Retain the time, Region, errors, and before-and-after configuration without exposing tokens or user data in support tickets. This article reports no configuration or provisioning tests in your account.

For unexpected results, distinguish caller permissions, target resources, endpoint/source-VPC controls, IP exceptions, and the separate SCIM path. Restoring old settings also requires a reviewed complete configuration and read-back verification. Do not hide the cause by allowing arbitrary IP sources.

Check networking costs separately from Identity Center pricing

AWS's FAQ says IAM Identity Center has no extra charge; the announcement lists no separate network-control fee. Check pricing for any separately provisioned endpoints or networking resources in the target Region. This does not establish a zero-cost architecture.

These controls determine whether particular identity-service requests may enter from a source. They do not change AWS eligibility, IAM authorization, or other platforms' rules. A proxy exit cannot replace those requirements. For general connectivity failures, consult the layered connection troubleshooting guide, then return to the service's actual permissions and network settings.