OIDC federation (Web Identity Federation)

Imagine that you are creating an application that accesses AWS resources, such as GitHub Actions that uses workflows to access Amazon S3 and DynamoDB.

When you use these workflows, you make requests to AWS services that must be signed with an AWS access key. However, we strongly recommend that you do not store AWS credentials long-term in applications outside AWS. Instead, configure your applications to request temporary AWS security credentials dynamically when needed using OIDC federation. The supplied temporary credentials map to an AWS role that only has permissions needed to perform the tasks required by the application.

With OIDC federation, you don't need to create custom sign-in code or manage your own user identities. Instead, you can use OIDC in applications, such as GitHub Actions or any other

OpenID Connect (OIDC)⁠

-compatible IdP, to authenticate with AWS. They receive an authentication token, known as a JSON Web Token (JWT), and then exchange that token for temporary security credentials in AWS that map to an IAM role with permissions to use specific resources in your AWS account. Using an IdP helps you keep your AWS account secure because you don't have to embed and distribute long-term security credentials with your application.

For most scenarios, we recommend that you use

Amazon Cognito⁠

because it acts as an identity broker and does much of the federation work for you. For details, see the following section,

Using Amazon Cognito for mobile apps⁠

⁠

OIDC federation - AWS Identity and Access Management Control access to your AWS resources with user identity (authentication) and with policies that define specific permissions (authorization). docs.aws.amazon.com⁠

⁠

Want to print your doc?
This is not the way.

Try clicking the ⋯ next to your doc name or using a keyboard shortcut (

CtrlP

) instead.