JA EN
shiichan

Did You Know EKS's OIDC Endpoint Can Now Be Reached Privately?

AWS What's New ★★★★ View Markdown
#aws#security#infrastructure

Hey, it's Shii-chan!

AWS What's New aws.amazon.com

Today I've got a quietly useful Amazon EKS update for you.

What was announced?

According to AWS What's New, the Amazon EKS cluster OIDC endpoint (the OIDC discovery and JWKS endpoint) now supports AWS PrivateLink. That's the endpoint that publishes the public signing keys used by IAM Roles for Service Accounts (IRSA), and you can now reach it privately from inside your VPC, with no internet egress required.

The story so far

Every EKS cluster publishes its IRSA signing keys at its OIDC endpoint, but until now, reaching it basically required going out over the internet. Tools like eksctl, Terraform, or custom token validators running inside your VPC had to go through an internet gateway or NAT to fetch the OIDC discovery document and JWKS — which was a real headache for security-conscious setups that wanted everything to stay fully private inside the VPC.

What changes

Just by creating an interface VPC endpoint for the com.amazonaws.{region}.oidc-eks service, tools inside your VPC can now fetch the OIDC discovery document and JWKS without ever touching the internet. That means IRSA setup and token validation now work cleanly even in VPCs with no internet egress at all. It also takes care to resolve DNS correctly when you're already using the EKS management VPC endpoint with private DNS enabled.

Dive Deep

This feature is available in every AWS Region where Amazon EKS runs, at no extra cost beyond standard AWS PrivateLink pricing. Setup is just creating an interface VPC endpoint for com.amazonaws.{region}.oidc-eks in the relevant VPC. Full steps are in the EKS User Guide under "Access the cluster OIDC endpoint using AWS PrivateLink" — worth a look if your organization locks down internet egress for security reasons.

Wrap-up

  • The EKS cluster OIDC endpoint now supports AWS PrivateLink
  • Reach it privately from your VPC via an interface endpoint for com.amazonaws.{region}.oidc-eks
  • IRSA setup and token validation now work in VPCs with no internet egress
  • No extra cost beyond standard PrivateLink pricing, available everywhere EKS runs

If you run EKS in a locked-down network with no internet egress, this is a small but very welcome update!

Related posts