Skip to main content
With AWS IAM outbound identity federation, any workload that runs as an IAM role can ask AWS STS for a signed JWT addressed to Bifrost. The token’s sub claim is the ARN of that role, for example arn:aws:iam::123456789012:role/payments-batch, and that ARN is what you map to a service account. Nothing is stored on either side: the workload uses the role credentials it already has.
Each AWS account has its own token issuer. Bifrost trusts only the accounts you add, never AWS as a whole.

​
Prerequisites

  • Permission to change the AWS account’s IAM settings and the workload role’s policy.
  • In Bifrost, the User Provisioning permission to add the account as a trusted issuer, and User Provisioning → UpdateWorkloadIdentities to map roles to service accounts.

​
Step 1: Turn on outbound identity federation

Do this once per AWS account, in the IAM console under Account settings → Outbound web identity federation, or with the AWS CLI:
AWS returns the account’s issuer URL, of the form https://<id>.tokens.sts.global.api.aws. You can read it again at any time:

​
Step 2: Add the account as a trusted issuer

  1. In Bifrost, open User Provisioning, edit your SSO provider, and go to Provider Configuration → Workload identity.
  2. Under Additional trusted issuers, select Add issuer, give it a name such as AWS prod, choose the AWS kind and paste the issuer URL. Mappings refer to the issuer by this name.
  3. Set the audience workloads will request tokens for. Bifrost suggests its own URL, such as https://bifrost.example.com.
  4. Select Test. Bifrost fetches the issuer’s discovery document and signing keys, so a typo or an account without federation turned on shows up here.
  5. Save the provider. Trusted issuers are part of the provider’s settings, so they are replaced if you switch to another identity provider.

​
Step 3: Let the role request tokens

Add sts:GetWebIdentityToken to the policy of the role the workload runs as: the Lambda execution role, ECS task role, EC2 instance profile or EKS pod role.

​
Step 4: Map the role to a service account

  1. Open the service account under Governance → Users and go to Workload identity.
  2. Select Add workload identity, choose your AWS issuer, and paste the IAM role ARN exactly as IAM shows it. ARNs are matched exactly, including the case of the role name.
  3. Select Add.

​
Step 5: Call Bifrost from the workload

The workload requests a token from a regional STS endpoint and sends it as the bearer token:
Request a new token before the current one expires. GetWebIdentityToken is not available on the global STS endpoint, and needs a recent AWS SDK.

​
Things to know

  • A recreated role has the same ARN. If a role is deleted and another is created with the same name, its tokens match the same mapping. Remove the mapping when you retire a role.
  • One issuer per account. Add each AWS account whose workloads should call Bifrost. Once roles are mapped on an issuer, its issuer URL can’t change; add a new account as another issuer.
  • Virtual keys keep working. Moving a workload to AWS tokens is opt-in per workload.