AWS Identity Store adds EventBridge change notifications

Identity changes become workflow triggers

AWS announced on October 28, 2026, that IAM Identity Center’s Identity Store now sends change notifications to Amazon EventBridge. AWS describes the events as real-time and says they cover creation, updates and deletion involving users, groups, group memberships and the identity store itself. Identity Store serves as the identity source for IAM Identity Center, which manages access across AWS accounts and applications. AWS announcement

AWS outlines workflows in which EventBridge rules trigger AWS Lambda functions to audit user provisioning, alert security information and event management (SIEM) systems, or update access in downstream applications. It also describes using changes to specific group memberships to automate onboarding and offboarding. These are examples of workflows teams can build, rather than automatic outcomes of receiving a notification. AWS workflow examples

Regional availability and pricing

AWS says change notifications are available in all AWS Regions where IAM Identity Center is available, with events sent in each enabled Region of an instance. The company states that notifications are available at no additional cost beyond standard Amazon EventBridge usage charges. AWS availability and pricing

Design for completed access changes

For platform teams, the useful distinction is between detecting an identity change and completing the downstream action it should trigger. Use a notification to start work, then confirm separately that the intended access change has succeeded.

Treat notifications as inputs to reconciliation: make handlers idempotent, record downstream outcomes and provide a recovery path for failed updates. For instances with multiple enabled Regions, decide which consumers are responsible for shared downstream systems before enabling automated actions.

Before relying on these notifications for security-critical offboarding, verify event ordering, delivery guarantees and retention in the service documentation. Design the workflow around confirmed downstream access changes—not notification receipt alone.