# Exposing AWS KMS Asymmetric Keys as a JWKS

DevFeed: [Exposing AWS KMS Asymmetric Keys as a JWKS](<https://devfeed.tech/articles/exposing-aws-kms-asymmetric-keys-as-a-jwks-20125.md>)

Original publisher: [Read original article](<https://benchling.engineering/exposing-aws-kms-asymmetric-keys-as-a-jwks-7f183657f0d9?source=rss----3d4aa8fb07ea---4>)

Author: Brian Maloney

Published: 2023-02-02T20:53:31Z

Content type: tutorial

Language: en

Sources: [Benchling](<https://devfeed.tech/sources/benchling.md>)

Topics: [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [Security](<https://devfeed.tech/topics/security.md>), [Amazon Web Services](<https://devfeed.tech/topics/aws.md>), [JSON Web Tokens](<https://devfeed.tech/topics/jwt.md>), [API](<https://devfeed.tech/topics/api.md>), [threat detection](<https://devfeed.tech/topics/threat-detection.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [aws](<https://devfeed.tech/tags/aws.md>), [benchling](<https://devfeed.tech/tags/benchling.md>), [encryption](<https://devfeed.tech/tags/encryption.md>), [engineering](<https://devfeed.tech/tags/engineering.md>), [enterprise](<https://devfeed.tech/tags/enterprise.md>), [identity](<https://devfeed.tech/tags/identity.md>), [jwks](<https://devfeed.tech/tags/jwks.md>), [least-privilege](<https://devfeed.tech/tags/least-privilege.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [oauth-2-0](<https://devfeed.tech/tags/oauth-2-0.md>), [oauth2](<https://devfeed.tech/tags/oauth2.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [openid-connect](<https://devfeed.tech/tags/openid-connect.md>), [private-key](<https://devfeed.tech/tags/private-key.md>), [public-key](<https://devfeed.tech/tags/public-key.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [security](<https://devfeed.tech/tags/security.md>), [threat-detection](<https://devfeed.tech/tags/threat-detection.md>), [token](<https://devfeed.tech/tags/token.md>)

## AI overview

This Benchling article discusses service-to-service authentication with OAuth 2.0 and OpenID Connect. It explains why administrator-generated API tokens create secret-management, attribution, and least-privilege problems, and introduces private_key_jwt authentication with public-key cryptography while considering AWS KMS for private-key management and JWKS exposure.

## Source excerpt

Here at Benchling, interaction with services is a large part of our business, from employees interacting with the software-as-a-service products with which we conduct our daily business, all the way down to interactions between the services that make up the Benchling application platform itself. Secure authentication and authorization to services is a long-standing issue in the industry, but one that has been improving in recent years due to the widespread adoption of modern standards such as OAuth 2.0 and OpenID Connect (OIDC). One specific use case for service-to-service authentication that is important to Benchling Security is connecting our Threat Detection Pipeline to our enterprise identity services vendor. We use this connection to connect log and other data provided by the vendor to our centralized Threat Detection Platform, where we correlate this with other sources of intelligence to detect risky or suspicious user activity in near real-time. Modern Authentication with OIDC Our specific identity services vendor offers two options for authenticating to its API: either an API token that an administrator can generate, or interaction by acting as an Application. API tokens, while very easy to use, are a poor choice for two reasons: First, they are a static secret that must be handled carefully and rotated frequently to mitigate the risk of a leaked key, which causes significant management overhead. Second, the identity services vendor links the privileges and identity of an API token inextricably to the administrator who generated it. This causes actions using the key to be attributed to the administrator and also makes it impossible to implement the principle of least privilege. Client authentication when acting as an Application allows the use of OIDC, and this vendor specifically requires the use of the private_key_jwt Client Authentication method. Enforcing this requirement is a good choice on the part of the vendor -- by using public-key encryption, no sec