Skip to main content
POST
Create an OIDC provider
Requires the IAM action iam:CreateOIDCProvider. See IAM permissions for the full list, what each one covers, and an example policy.

Authorizations

Authorization
string
header
required

An OAuth 2.0 bearer token, sent as Authorization: Bearer <token>. This is the recommended way to authenticate.

Get one by exchanging a service account's access key pair at POST /v1/oauth/token with grant_type=client_credentials. It is the standard client-credentials grant, so any OAuth-aware library will obtain and refresh it for you.

Tokens last an hour by default. The same access key pair is separately your AWS SigV4 credential for the S3-compatible object endpoint, which speaks nothing else.

Body

application/json
name
string
required
Example:

"github"

issuer
string<uri>
required

Immutable HTTPS issuer URL. Public discovery and JWKS endpoints are required for customer providers.

Example:

"https://token.actions.githubusercontent.com"

audiences
string[]
required
Required array length: 1 - 100 elements
Required string length: 1 - 255
Example:
description
string
tags
object

Response

Create an OIDC provider

oidc_provider
object
required