--- title: Amazon Neptune now supports tag-based access control for IAM description: Amazon Neptune now supports tag-based access control (TBAC) for IAM, allowing administrators to use AWS resource tags and IAM principal tags as conditions in... canonical: https://daily.dev/posts/amazon-neptune-now-supports-tag-based-access-control-for-iam-791kiv8al twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Amazon Neptune now supports tag-based access control for IAM | daily.dev og:description: Amazon Neptune now supports tag-based access control (TBAC) for IAM, allowing administrators to use AWS resource tags and IAM principal tags as conditions in... og:url: https://daily.dev/posts/amazon-neptune-now-supports-tag-based-access-control-for-iam-791kiv8al og:image: https://api.daily.dev/og/posts/791kIV8Al.png og:image:alt: Amazon Neptune now supports tag-based access control for IAM og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Amazon Neptune now supports tag-based access control for IAM **[AWS](https://daily.dev/sources/aws)** · 2 min read · 0 upvotes · 1 comments ## Summary Amazon Neptune now supports tag-based access control (TBAC) for IAM, allowing administrators to use AWS resource tags and IAM principal tags as conditions in IAM policies and Service Control Policies (SCPs) to govern access to Neptune data-plane operations. With TBAC, IAM principals can only perform actions against Neptune clusters whose tags match their own, eliminating lateral access risk in shared VPC environments and enabling team/environment-level isolation. The feature supports federated identity workflows via SAML or OIDC session tags and is available in all AWS regions where Neptune is offered, requiring engine version 1.2.0.0 or later with IAM authentication enabled. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What Neptune engine version is required to use tag-based access control (TBAC) for IAM? Neptune engine version 1.2.0.0 or later is required, along with IAM authentication enabled on the cluster. Tag-based access control lets IAM principals perform neptune-db actions only against clusters whose resource tags match their own principal tags, and it is available in all AWS regions where Neptune is offered. _Track Neptune's IAM and access-control updates on daily.dev before rolling out cluster policy changes._ ### How does tag-based access control restrict which Neptune clusters an IAM principal can reach? An IAM principal tagged with a value like Project=FraudDetection can only perform neptune-db actions on Neptune clusters carrying that same tag, without the policy needing to list specific cluster ARNs. This limits lateral access within shared VPCs and supports team, environment, or project-level isolation, including federated SAML or OIDC session tags from external identity providers. _Developers designing multi-tenant Neptune access boundaries can follow this pattern via daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@trevorsuna** · 0 upvotes > Tag-based access is a big win for shared environments. Matching principal and cluster tags is much easier to scale than writing a new policy for every team, but keeping the tagging rules clean will be the real test. ## Similar posts on daily.dev - [Introducing attribute-based access control for Amazon S3 general purpose buckets](https://daily.dev/posts/introducing-attribute-based-access-control-for-amazon-s3-general-purpose-buckets-5rdbbb8ga) · AWS · 1 upvotes · 0 comments - [Amazon Neptune now supports AWS CloudFormation for global databases](https://daily.dev/posts/amazon-neptune-now-supports-aws-cloudformation-for-global-databases-pngnx9rvr) · AWS · 0 upvotes · 0 comments - [Pulumi IAM Expands: Manage Access at Scale with Tags, Roles, and Teams](https://daily.dev/posts/pulumi-iam-expands-manage-access-at-scale-with-tags-roles-and-teams-t4dmxo3pj) · Pulumi · 0 upvotes · 0 comments - [Neptune Combines AI‑Assisted Infrastructure as Code and Cloud Deployments](https://daily.dev/posts/neptune-combines-ai-assisted-infrastructure-as-code-and-cloud-deployments-cqk6nqp6k) · InfoQ · 0 upvotes · 0 comments - [Securing agentic AI: What's new in VPC Service Controls](https://daily.dev/posts/securing-agentic-ai-what-s-new-in-vpc-service-controls-yzc0v8hcp) · Google Cloud · 1 upvotes · 0 comments --- Tags: [#aws](https://daily.dev/tags/aws), [#aws-iam](https://daily.dev/tags/aws-iam) [View this post on daily.dev](https://daily.dev/posts/amazon-neptune-now-supports-tag-based-access-control-for-iam-791kiv8al) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Amazon Neptune now supports tag-based access control for IAM","url":"https://daily.dev/posts/amazon-neptune-now-supports-tag-based-access-control-for-iam-791kiv8al","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/amazon-neptune-now-supports-tag-based-access-control-for-iam-791kiv8al"},"datePublished":"2026-07-28T00:08:48.233Z","dateModified":"2026-09-13T21:43:54.090Z","description":"Amazon Neptune now supports tag-based access control (TBAC) for IAM, allowing administrators to use AWS resource tags and IAM principal tags as conditions in...","image":"https://media.daily.dev/image/upload/s--P4t4XyoV--/f_auto/v1722860399/public/Placeholder%2001","thumbnailUrl":"https://media.daily.dev/image/upload/s--P4t4XyoV--/f_auto/v1722860399/public/Placeholder%2001","isAccessibleForFree":true,"articleSection":"AWS","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"AWS","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/aws","url":"https://daily.dev/sources/aws"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/amazon-neptune-now-supports-tag-based-access-control-for-iam-791kiv8al","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"aws,aws-iam","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"AWS","item":"https://daily.dev/sources/aws"},{"@type":"ListItem","position":3,"name":"Amazon Neptune now supports tag-based access control for IAM"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/amazon-neptune-now-supports-tag-based-access-control-for-iam-791kiv8al","comment":[{"@type":"Comment","text":"Tag-based access is a big win for shared environments. Matching principal and cluster tags is much easier to scale than writing a new policy for every team, but keeping the tagging rules clean will be the real test.","datePublished":"2026-07-28T03:00:32.500Z","url":"https://daily.dev/posts/791kIV8Al#c-f99GazTBO","author":{"@type":"Person","name":"Trevor Suna","url":"https://daily.dev/trevorsuna","image":"https://media.daily.dev/image/upload/s--dZ7gXxpp--/f_auto/v1784081551/avatars/avatar_EMoP47rpuw8DNjhp6R1b6?_a=BAMAMicg0"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/amazon-neptune-now-supports-tag-based-access-control-for-iam-791kiv8al#faq","mainEntity":[{"@type":"Question","name":"What Neptune engine version is required to use tag-based access control (TBAC) for IAM?","acceptedAnswer":{"@type":"Answer","text":"Neptune engine version 1.2.0.0 or later is required, along with IAM authentication enabled on the cluster. Tag-based access control lets IAM principals perform neptune-db actions only against clusters whose resource tags match their own principal tags, and it is available in all AWS regions where Neptune is offered. Track Neptune's IAM and access-control updates on daily.dev before rolling out cluster policy changes."}},{"@type":"Question","name":"How does tag-based access control restrict which Neptune clusters an IAM principal can reach?","acceptedAnswer":{"@type":"Answer","text":"An IAM principal tagged with a value like Project=FraudDetection can only perform neptune-db actions on Neptune clusters carrying that same tag, without the policy needing to list specific cluster ARNs. This limits lateral access within shared VPCs and supports team, environment, or project-level isolation, including federated SAML or OIDC session tags from external identity providers. Developers designing multi-tenant Neptune access boundaries can follow this pattern via daily.dev."}}]} ```