Access change propagation

In IAM, access changes, such as granting a role or denying a permission, are eventually consistent. This means that it takes time for access changes to propagate through the system. In the meantime, recent access changes might not be effective everywhere. For example, principals might still be able to use a recently revoked role or a recently denied permission. Alternatively, they might not be able to use a recently granted role or a permission they were, until recently, denied from using.

Changes to allow or deny policies typically propagate in 2 minutes, but could potentially take 7 minutes or longer.