JA EN
shiichan

Goodbye Public Internet: AWS IAM's OIDC Verification Key Lookup Now Works via VPC Endpoints!

AWS What's New ★★★★ View Markdown
#aws#security#infrastructure

Hey everyone, it's me! I found a quiet but really satisfying security update from AWS today. It's about workloads inside VPCs with restricted internet access finally being able to complete their authentication traffic without ever touching the public internet!

AWS What's New aws.amazon.com

What was announced?

This is an announcement from AWS What's New: AWS IAM's outbound identity federation feature now supports interface VPC endpoints for the OIDC discovery API.

Specifically, you can now reach the OIDC discovery metadata and JWKS (JSON Web Key Set) verification key endpoints - which external services use to verify JWTs issued by AWS STS - over AWS PrivateLink.

The story so far

Until now, these OIDC discovery endpoints were only reachable over the public internet. That meant a workload running inside a VPC with restricted internet access simply couldn't retrieve the verification keys it needed to verify JWTs.

What changes

By creating an interface VPC endpoint, you can now reach the OIDC discovery endpoints while keeping the verification key retrieval traffic entirely within the AWS network.

  • Organizations with strict network security requirements that restrict internet access from their VPCs
  • Workloads that still need external services to verify JWTs issued by AWS STS

For both of these, verification keys can now be pulled in securely without ever crossing the public internet.

Dive Deep

Let me walk through how this works. IAM outbound identity federation lets workloads access external services without relying on long-lived credentials. Instead, a workload requests a short-lived JWT (JSON Web Token) from AWS STS and presents that to the external service.

The external service then needs to verify that the JWT is genuine, and it does so by checking the metadata and JWKS (the set of public verification keys) published at the OIDC discovery endpoints. With this launch, you can now reach those endpoints through an interface VPC endpoint over AWS PrivateLink.

This is available in all commercial AWS Regions, the AWS GovCloud (US) Regions, and the China Regions - a pretty wide rollout already. And there's no extra charge beyond standard AWS PrivateLink pricing.

Wrap-up

  • The OIDC discovery API in AWS IAM's outbound identity federation now supports interface VPC endpoints
  • Previously, these endpoints were only reachable over the public internet, blocking verification from internet-restricted VPCs
  • With AWS PrivateLink support, verification key retrieval traffic can now stay entirely within the AWS network
  • Available in all commercial Regions plus GovCloud (US) and China Regions, at no extra charge

If you're running a tightly locked-down VPC and juggling external service verification, this update should take a real weight off your shoulders!

Related posts