Amazon Patents a Way to Track the Original Identity Behind Assumed AWS Roles

By Patentlyze Team · Updated May 22, 2026

When an AWS user or service assumes a new IAM role, the original identity can get lost in the audit trail. Amazon's new patent wants to make sure it never disappears.

What Amazon's persistent identity trail actually does

Imagine you log into your company's AWS account, then your code automatically switches into a more powerful "deployment" role to push an update. Something goes wrong — a resource gets deleted — and the security team pulls the logs. The logs show the deployment role did it, but who triggered that role? That's the gap this patent addresses.

Amazon's idea is to attach a Persistent Source Value (PSV) — essentially a sticky ID tag — to your credentials at the start. Every time you (or your application) assumes a new role, that PSV travels along for the ride. It gets baked into the new credentials and written into every log entry made under that assumed identity.

The result: no matter how many role-hops happen across AWS services, security teams can always trace an action back to the original user or application that started the chain. It's like a luggage tag that survives every connecting flight.

How the PSV tag survives each role-assumption hop

AWS Identity and Access Management (IAM) lets users and applications assume roles — temporarily adopt a different set of permissions to do a specific job. This is normal and healthy practice, but it creates an audit problem: once you assume a role, the credentials you use look like they belong to that role, not to you.

This patent introduces a Persistent Source Value (PSV), a piece of identity metadata that an entity includes when it requests to assume a new identity. The IAM manager (the service brokering the role switch) authenticates the request, checks a PSV policy (a configurable rule set governing whether the PSV should be copied, modified, or blocked), and then embeds the PSV into the newly issued credentials.

Key behaviors the patent describes:

• The PSV is copied forward each time a role is assumed, so it persists across chains of role assumptions.
• A log agent running alongside compute, storage, and database services captures the PSV in every access log entry made using the assumed credentials.
• The PSV policy layer lets account administrators control which entities can set or carry a PSV, preventing spoofing.

The net effect is a reliable, tamper-resistant breadcrumb linking every downstream action back to the originating identity — without changing how role assumption itself works.

Why AWS security teams should pay close attention

Cloud security investigations live and die by audit trails. Tools like AWS CloudTrail already log API calls, but multi-hop role assumption can obscure the human or service account that started a chain of events. Ransomware actors, insider threats, and misconfigured automation all exploit exactly this kind of identity ambiguity. A persistent, policy-governed source tag stitches those gaps closed at the credential layer — before the log is even written.

For you as an AWS customer, this could mean cleaner incident response, simpler compliance reporting (SOC 2, PCI DSS auditors love a clear chain of custody), and less time manually correlating CloudTrail events across assumed roles. It's also a meaningful signal that Amazon is investing in making IAM's audit surface more robust as multi-account, multi-service architectures become the norm.

Editorial commentary on a publicly published patent application. Not legal advice.