IAM is probably decentralized using trusted CA certificates to allow other AWS services to validate tokens previously created by IAM when it wasn't down. Yeah if you want new tokens you are just out of luck, but existing ones will keep working.