The OIDC Provider

An IAM OIDC identity provider connects your cluster's service accounts to AWS IAM — the foundation of IRSA.

Every EKS cluster publishes an OpenID Connect (OIDC) issuer URL. To use IRSA you must register that issuer as an IAM OIDC identity provider in your AWS account. This tells IAM to trust tokens signed by your cluster.

Why it's needed

When a pod requests AWS credentials, AWS STS checks that the service account token was signed by a trusted OIDC provider. Without the provider registered, the trust chain is broken and IRSA fails.

One-time setup

You associate the provider once per cluster. eksctl does it with a single flag; you can also do it manually with the AWS CLI.

Example

Example · bash
# Associate the cluster's OIDC provider with IAM (one time)
eksctl utils associate-iam-oidc-provider \
  --cluster demo \
  --approve

# Find the cluster's OIDC issuer URL
aws eks describe-cluster --name demo \
  --query 'cluster.identity.oidc.issuer' --output text

When to use it

  • A platform team creates a cluster OIDC provider so they can create IRSA service accounts that let pods assume IAM roles without static credentials.
  • A security team verifies the OIDC issuer URL matches the cluster before creating trust policies, preventing cross-cluster token acceptance.
  • A Terraform module creates the OIDC provider automatically during cluster provisioning so IRSA is available from day one.

More examples

Create OIDC provider for cluster

Associates an IAM OIDC identity provider with the cluster, which is the prerequisite step before any IRSA service accounts can be created.

Example · bash
eksctl utils associate-iam-oidc-provider \
  --cluster prod \
  --approve

Get OIDC issuer URL

Retrieves the cluster's OIDC issuer URL, used when manually constructing IAM trust policies for IRSA roles.

Example · bash
aws eks describe-cluster \
  --name prod \
  --query 'cluster.identity.oidc.issuer' \
  --output text

OIDC provider in Terraform

Terraform resources that create the IAM OIDC provider for an EKS cluster using the cluster's issuer URL and TLS certificate thumbprint.

Example · hcl
data "tls_certificate" "eks" {
  url = data.aws_eks_cluster.prod.identity[0].oidc[0].issuer
}
resource "aws_iam_openid_connect_provider" "eks" {
  client_id_list  = ["sts.amazonaws.com"]
  thumbprint_list = [data.tls_certificate.eks.certificates[0].sha1_fingerprint]
  url             = data.aws_eks_cluster.prod.identity[0].oidc[0].issuer
}

Related

eks irsaeks iam authentication

Discussion

  • Be the first to comment on this lesson.