ReleaseBytes
aws AWS What's New ·

Amazon Neptune adds IAM tag-based access control for data plane operations

securityawsaws-iam
feature

Amazon Neptune now supports tag-based access control (TBAC) for IAM, allowing control over data-plane operations using resource and principal tags. This enhances security for large-scale deployments by enabling dynamic, attribute-based access management, reducing the need to manage individual cluster ARNs in policies. The feature is available in all AWS Regions for Neptune engine version 1.2.0.0 or later with IAM authentication enabled.

  • →IAM tag-based access control for Neptune data-plane operations
  • →Dynamic access governance and isolation
  • →Availability and prerequisites
Features (1) ›
  • IAM tag-based access control for Neptune data-plane operations

    Amazon Neptune now supports tag-based access control (TBAC) enabling users to control access to data-plane operations using AWS resource tags and IAM principal tags in IAM policies and SCPs. This feature helps manage access dynamically without enumerating specific cluster ARNs.

Enhancements (1) ›
  • Dynamic access governance and isolation

    TBAC allows administrators to govern cluster access dynamically, restricting principals to clusters whose tags match their own, thus eliminating lateral access risk and enforcing team/environment-level isolation. It also supports federated identity workflows using SAML or OIDC session tags.

Notes (1) ›
  • Availability and prerequisites

    This feature is available in all AWS Regions where Amazon Neptune is offered. It requires Neptune engine version 1.2.0.0 or later and IAM authentication to be enabled.

Read the original announcement →

https://aws.amazon.com/about-aws/whats-new/2026/07/amazon-neptune-tbac/

Related releases