Aembit has released an update to support AWS Role-Based Trust Providers.
The ability to create and use different types of Trust Providers in your Aembit environment enables you to have flexibility in how resources are managed. With this enhancement, you now have an additional option when selecting a Trust Provider.
For more information on AWS Role-Based Trust Providers, please see the AWS Role Trust Provider page.
Many organizations have certain security requirements that specify which resources should be managed by a group. To address these security needs, Aembit has released a new Resource Sets feature that enables you to determine which groups will have access to various resources.
You may find it necessary to segment management responsibilities for certain entities and resources in your Aembit environment between different individuals and groups for security reasons. To accommodate this requirement, Aembit has released the Resource Sets feature.
Resource Sets enable you to group entities and resources (e.g. Credential Providers, Trust Providers, Identity Providers, etc.) into a single collection and assign specific users to manage these resources.
For more detailed technical information on how to use create and manage Resource Sets, please refer to the Resource Sets technical documentation.
In some cases, you may find it necessary to manually shut down Agent Proxy when the main container exits, but a sidecar is still running. Since you may not want to kill the whole job, since it will look like a cancelled job, Aembit now provides a solution that enables you to gracefully terminate the job while allowing the sidecar to still run.
For more detailed information on this feature, please refer to the Agent Proxy Shutdown page.
There are many different deployment options you can currently use to deploy Aembit Edge Components in your environment, including GitHub Actions, GitLab Jobs, and Kubernetes.
To increase the available deployment options for our users, Aembit now provides support for users who wish to deploy Aembit Edge Components to an Amazon Web Services (AWS) Lambda Container.
For more detailed information on how to deploy Aembit Edge Components to AWS Lambda Containers, please refer to the AWS Lambda Container technical documentation.
Aembit has released two new features on Aembit Cloud:
You may now configure and add Aembit GeoIP conditions in your Aembit Tenant. This new Access Condition type enables you to explicitly designate which countries/regions will have access to Server Workloads from policy-enabled Client Workloads.
For more information on this feature, please refer to the Access Conditions for GeoIP Restriction page.
Aembit now supports Log Streams that target Google Cloud Storage (GCS) Buckets. You may add or configure this new Log Stream destination type in the Administration tab of your Aembit Tenant.
For more information on this feature, please refer to the Google Cloud Storage Bucket Log Streams page.
Aembit Edge Components now support virtual machine deployments to virtual machines running Red Hat 8.9.
Aembit now supports GitLab CI/CD Jobs as Client Workloads.
For more information on how to configure GitLabs Jobs with Aembit Client Workloads, please refer to the Script-based Agent page.
An issue was identified in the Agent Controller component due to the non-rotation of the public/private key pair used for Kerberos attestation. This issue has been resolved by implementing a process by which these private/public key pairs will be automatically rotated when the certificate reaches 80% of its lifespan.
Aembit has released a Kerberos Trust Provider that enables the attestation of Client Workloads running in virtual machine environments joined to Active Directory. This attestation method is specifically designed for on-premise deployments where alternative attestation methods, such as AWS or Azure metadata service trust providers, are not available.
For more detailed information on this Kerberos Trust Provider, please refer to the Kerberos Trust Provider technical documentation.
Aembit now supports secure communication between Agent Proxy and Agent Controller using Transport Layer Security (TLS) for both Kubernetes and virtual machine deployments.
For more information on how to configure TLS for Agent Controller, please refer to the Configuring TLS for Agent Controller documentation.
Aembit has officially released a Terraform Provider to the Hashicorp Terraform Registry.
The Aembit Terraform Provider enables users to manage Aembit Cloud resources using terraform manually or via CI/CD workflows.
For more detailed information about the Aembit Terraform Provider, please see the Aembit Terraform documentation.
Aembit now supports SAML/SSO authentication for administrators who wish to simplify the Aembit Tenant login process for their users. Instead of requiring a user to enter their username/password credentials every time a user tries to access the Aembit Tenant, users will now be able to use a 3rd party SAML SSO Provider (e.g. Google, Okta, Microsoft Entrata) to log into the tenant.
For more information on how to configure Identity Providers using SAML, please see the Configuring Identity Providers technical documentation.
Aembit now supports Wiz integration. Using the Wiz Integration API, you can work with both your Aembit Tenant and Wiz to identify customer assets and vulnerabilities.
For more detailed information about the Aembit -> Wiz integration, please refer to the Wiz Integration page on the Aembit technical documentation site.
Aembit has now enabled support for Access Authorization Events. Access Authorization Events enable customers to observe credential requests.
Aembit supports Google CloudRun Jobs as Client Workloads. With this support, you can now:
authenticate to the Aembit IdP using Attestation with the GCP Cloud Run Job Identity
request and retrieve a secret from GCP Secret Manager
Aembit now supports integration with CrowdStrike. This integration allows you to leverage CrowdStrike’s service to prevent Server Workload access from Client Workloads that do not meet an expected state.
For more information about this integration, please refer to the CrowdStrike Integration page on the Aembit technical documentation site.
The Aembit Agent Controller can now be installed in high availability configurations. Because the Agent Controller is a critical Aembit Edge Component that manages Agent Proxy registration and credential acquisition for Aembit Cloud access, HA support was necessary to ensure the continuous availability of the Agent Controller.
For information on installing and configuring Agent Controller in high availability environments, please see the Agent Controller High Availability page.
In an effort to ensure only Client Workloads that run in a secure environment can access Server Workloads, Aembit has enabled integrations with CrowdStrike and its CrowdStrike Falcon Sensor. CrowdStrike Falcon Sensor checks multiple items on the virtual machine (VM) to verify the VM is secure.
Several new feature updates and additions have been made to improve Aembit user experience. These updates include:
Aembit now supports Multi-Factor Authentication (MFA) so users can provide different authentication methods. Users can:
Users may now deploy Aembit Edge Components to VMs (non-Kubernetes). This feature enables users to have options on how they want to deploy these components.
For more detailed information about this feature, please see the virtual machine Installation page.
Aembit has released a new feature for Credential Providers called “Dynamic Claims.” This feature allows you to set the Subject claim and Custom claims with either literal strings or dynamic values when setting up Credential Providers in your Aembit client tenant.
For more detailed information about Dynamic Claims, please refer to Dynamic Claims page
This feature is currently only supported for Vault integration.