OIDC with AWS

See the general OIDC documentation before diving into the AWS-specific setup.

AWS specific setup

When configuring the token in the RWX Vault UI, it's customary to name the token aws and set the audience to sts.amazonaws.com.

After setting the name and audience in the UI, you'll see copyable audience and subject values that you can copy to your OIDC role configuration in AWS.

You can then reference the token in RWX run definitions like this:

${{ vaults.your-vault.oidc.aws }}

Once AWS is configured to accept the token, use the aws/assume-role package to configure role assumption. Tasks that need to assume this role must use the assume-role task and supply an OIDC token as an environment variable. For example:

- key: aws-cli
  call: aws/install-cli 1.1.0

- key: assume-role
  call: aws/assume-role 2.1.0
  with:
    region: us-east-2
    role-to-assume: arn:aws:iam::your-account-id:role/your-role

- key: task-that-needs-role
  use: [aws-cli, assume-role]
  run: ...
  env:
    AWS_OIDC_TOKEN_PATH: ${{ vaults.your-vault.oidc.aws.path }}

The package accepts either a token file path in AWS_OIDC_TOKEN_PATH or the token contents in AWS_OIDC_TOKEN, but not both. With AWS_OIDC_TOKEN_PATH, the AWS CLI and compatible AWS libraries reread the refreshed token when their temporary credentials expire. Every task that assumes the role must provide one of these environment variables.

See the documentation for the aws/assume-role package for more information.

OIDC provider

See the AWS documentation on Creating OpenID Connect (OIDC) identity providers.

Set the provider URL to https://cloud.rwx.com/mint

Set the audience to the value that you configured in the RWX Vault UI, which is customarily sts.amazonaws.com

OIDC role

Follow the AWS documentation on creating a role for OpenID Connect Federation.

You'll want to add a condition based on the aud and sub claims of the OIDC token.

You can find the vault that you should set for sub in the Vaults UI for the token that you configured.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::012345678910:oidc-provider/cloud.rwx.com/mint"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "cloud.rwx.com/mint:aud": "sts.amazonaws.com",
          "cloud.rwx.com/mint:sub": "<your-vault-sub-here>"
        }
      }
    }
  ]
}

Terraform

If you use Terraform, you can use this template to configure OIDC with AWS:

# RWX OIDC Provider

resource "aws_iam_openid_connect_provider" "rwx" {
  url            = "https://cloud.rwx.com/mint"
  client_id_list = ["sts.amazonaws.com"]
}

# Deployment Role

resource "aws_iam_role" "name_of_your_role" {
  name = "<name-of-your-role>"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRoleWithWebIdentity"
        Effect = "Allow"
        Principal = {
          Federated = aws_iam_openid_connect_provider.rwx.arn
        }
        Condition = {
          StringEquals = {
            "cloud.rwx.com/mint:aud" = "sts.amazonaws.com",
            "cloud.rwx.com/mint:sub" = "<your-vault-sub-here>"
          }
        }
      }
    ]
  })
}

data "aws_iam_policy_document" "name_of_your_role" {
  # your statements here
}

resource "aws_iam_role_policy" "name_of_your_role" {
  name   = "<name-of-your-role-policy>"
  role   = aws_iam_role.name_of_your_role.id
  policy = data.aws_iam_policy_document.name_of_your_role.json
}