Simplify access to external services using AWS IAM Outbound Identity Federation

This article announces AWS IAM Outbound Identity Federation, a new capability enabling secure access to external services using short-lived JWTs instead of long-term credentials.

• Exchange AWS IAM credentials for short-lived JSON Web Tokens (JWTs) to authenticate with external services
• Eliminates security risks associated with storing long-term API keys and passwords
• AWS STS GetWebIdentityToken API generates cryptographically signed JWTs asserting AWS identity
• External services verify token authenticity using AWS's public JWKS endpoint
• Configure IAM permissions with sts:GetWebIdentityToken to enable token generation
• Supports ES384 and RS256 signing algorithms with configurable token lifetime (60 seconds to 1 hour)
• Includes standard OIDC claims plus AWS-specific metadata like account ID and principal tags
• Available at no additional cost in all AWS commercial, GovCloud, and China regions

AWS IAM Outbound Identity Federation simplifies multi-cloud and external service integration by enabling secure, credential-free authentication through short-lived identity tokens.