AWS IAM outbound identity federation now supports interface VPC endpoints for OIDC discovery
AWS IAM outbound identity federation now allows private access to OIDC discovery endpoints via VPC interface endpoints, eliminating public internet exposure for token verification keys.
AWS Identity and Access Management (IAM) outbound identity federation now supports Amazon Virtual Private Cloud (VPC) endpoints for OpenID Connect (OIDC) discovery APIs. This enables workloads inside a VPC to access OIDC discovery metadata and JSON Web Key Set (JWKS) verification keys privately using AWS PrivateLink, without routing traffic over the public internet.
Previously, these OIDC discovery endpoints were only accessible via the public internet, which prevented verifying workloads in VPCs with restricted internet access from retrieving verification keys. The new capability allows organizations to meet strict network security requirements while still enabling external services to validate JSON Web Tokens (JWTs) issued by AWS Security Token Service (AWS STS).
To use this feature, customers can create an interface VPC endpoint to privately reach the OIDC discovery endpoints. This ensures that JWT verification key retrieval remains within the AWS network, reducing exposure to potential internet-based threats and simplifying compliance with internal security policies.
The feature is available in all commercial AWS Regions, the AWS GovCloud (US) Regions, and China Regions. There is no additional charge beyond standard AWS PrivateLink pricing, making the capability accessible without extra costs for eligible workloads.