Create a role for OpenID Connect federation (console)

Sign up with one or more services offering federated OIDC identity. If you are creating an app that needs access to your AWS resources, you also configure your app with the provider information. When you do, the provider gives you an application or audience ID that is unique to your app. (Different providers use different terminology for this process. This guide uses the term configure for the process of identifying your app with the provider.) You can configure multiple apps with each provider, or multiple providers with a single app. View information about using the identity providers as follows:

After you receive the required information from the IdP, create an IdP in IAM. For more information, see Create an OpenID Connect (OIDC) identity provider in IAM.

Prepare the policies for the role that the IdP-authenticated users will assume. As with any role, a role for a mobile app includes two policies. One is the trust policy that specifies who can assume the role. The other is the permissions policy that specifies the AWS actions and resources that the mobile app is allowed or denied access to.

For web IdPs, we recommend that you use Amazon Cognito to manage identities. In this case, use a trust policy similar to this example.

{
    "Version": "2012-10-17",
    "Statement": {
        "Effect": "Allow",
        "Principal": {"Federated": "cognito-identity.amazonaws.com"},
        "Action": "sts:AssumeRoleWithWebIdentity",
        "Condition": {
            "StringEquals": {"cognito-identity.amazonaws.com:aud": "us-east-2:12345678-abcd-abcd-abcd-123456"},
            "ForAnyValue:StringLike": {"cognito-identity.amazonaws.com:amr": "unauthenticated"}
        }
    }
}

Replace us-east-2:12345678-abcd-abcd-abcd-123456 with the identity pool ID that Amazon Cognito assigns to you.

If you manually configure an OIDC IdP, when you create the trust policy, you must use three values that ensure that only your app can assume the role:

If a user uses a mobile app to sign in from Login with Amazon, the following example trust policy would apply. In the example, amzn1.application-oa2-123456 represents the app ID that Amazon assigns when you configured the app using Login with Amazon.

{
      "Version": "2012-10-17",
      "Statement": [{
          "Sid": "RoleForLoginWithAmazon",
          "Effect": "Allow",
          "Principal": {"Federated": "www.amazon.com"},
          "Action": "sts:AssumeRoleWithWebIdentity",
          "Condition": {"StringEquals": {"www.amazon.com:app_id": "amzn1.application-oa2-123456"}}
      }]
  }
        

If a user uses a mobile app to sign in from Facebook, the following example trust policy would apply. In this example, 111222333444555 represents the app ID that Facebook assigns.

{
      "Version": "2012-10-17",
      "Statement": [{
          "Sid": "RoleForFacebook",
          "Effect": "Allow",
          "Principal": {"Federated": "graph.facebook.com"},
          "Action": "sts:AssumeRoleWithWebIdentity",
          "Condition": {"StringEquals": {"graph.facebook.com:app_id": "111222333444555"}}
      }]
  }
        

If a user uses a mobile app to sign in from Google, the following example trust policy would apply. In this example, 666777888999000 represents the app ID that Google assigns.

{
      "Version": "2012-10-17",
      "Statement": [{
          "Sid": "RoleForGoogle",
          "Effect": "Allow",
          "Principal": {"Federated": "accounts.google.com"},
          "Action": "sts:AssumeRoleWithWebIdentity",
          "Condition": {"StringEquals": {"accounts.google.com:aud": "666777888999000"}}
      }]
  }
        

If a user uses a mobile app to sign in from Amazon Cognito, the following example trust policy would apply. In this example, us-east:12345678-ffff-ffff-ffff-123456 represents the identity pool ID that Amazon Cognito assigns.

{
      "Version": "2012-10-17",
      "Statement": [{
          "Sid": "RoleForCognito",
          "Effect": "Allow",
          "Principal": {"Federated": "cognito-identity.amazonaws.com"},
          "Action": "sts:AssumeRoleWithWebIdentity",
          "Condition": {"StringEquals": {"cognito-identity.amazonaws.com:aud": "us-east:12345678-ffff-ffff-ffff-123456"}}
      }]
  }
        

Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.

In the navigation pane, choose Roles and then choose Create role.

Choose Web identity as the trusted entity type and select Next.

For Identity provider, choose the IdP for your role:

Enter the identifier for your application. The label of the identifier changes based on the provider you choose:

(Optional) For Condition (optional), choose Add Condition to create additional conditions that must be met before users of your application can use the permissions that the role grants. For example, you can add a condition that grants access to AWS resources only for a specific IAM user ID. You can also add conditions to the trust policy after the role is created. For more information, see Update a role trust policy .

Review your OIDC information and then choose Next.

IAM includes a list of the AWS managed and customer managed policies in your account. Select the policy to use for the permissions policy, or choose Create policy to open a new browser tab and create a new policy from scratch. For more information, see Creating IAM policies. After you create the policy, close that tab and return to your original tab. Select the checkbox next to the permissions policies that you want OIDC users to have. If you prefer, you can select no policies at this time, and then attach policies to the role later. By default, a role has no permissions.

(Optional) Set a permissions boundary. This is an advanced feature.

Open the Permissions boundary section and choose Use a permissions boundary to control the maximum role permissions. Select the policy to use for the permissions boundary.

Choose Next.

For Role name, enter a role name. Role names must be unique within your AWS account. They are not case dependent. For example, you can't create roles named both PRODROLE and prodrole. Because other AWS resources might reference the role, you can't edit the name of the role after you create it.

(Optional) For Description, enter a description for the new role.

To edit the use cases and permissions for the role, choose Edit in the Step 1: Select trusted entities or Step 2: Add permissions sections.

(Optional) To add metadata to the role, attach tags as key–value pairs. For more information about using tags in IAM, see Tags for AWS Identity and Access Management resources.

Review the role and then choose Create role.