# OIDC workload identity on AWS

DevFeed: [OIDC workload identity on AWS](<https://devfeed.tech/articles/oidc-workload-identity-on-aws-29188.md>)

Original publisher: [Read original article](<https://www.latacora.com/blog/2025/11/04/aws-oidc-workload-identity/>)

Published: 2025-11-04T15:00:00Z

Content type: tutorial

Language: en

Sources: [Latacora](<https://devfeed.tech/sources/latacora.md>)

Topics: [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>), [Amazon Web Services](<https://devfeed.tech/topics/aws.md>), [AWS IAM](<https://devfeed.tech/topics/aws-iam.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [Cloud](<https://devfeed.tech/topics/cloud.md>), [implementation](<https://devfeed.tech/topics/implementation.md>), [Amazon EC2](<https://devfeed.tech/topics/amazon-ec2.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [aws](<https://devfeed.tech/tags/aws.md>), [aws-iam](<https://devfeed.tech/tags/aws-iam.md>), [identity](<https://devfeed.tech/tags/identity.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [vpc](<https://devfeed.tech/tags/vpc.md>)

## AI overview

This article explains workload identity on AWS and presents aws-oidc-token-exchange, an open-source bridge that allows AWS workloads to authenticate to OIDC-based services using existing IAM identities. It describes short-lived, platform-issued identity tokens as an alternative to managing API keys, passwords, and certificates.

## Source excerpt

Update: after years of being on the wish list of a ton of top AWS teams, AWS released a built-in version of this feature about two weeks after we published this. Never let it be said gentle ribbing doesn't work. Also, thanks AWS! We meant it when we said that the only thing better than having something easy to deploy was not needing to deploy anything at all. Everything in this post about workload identity is still relevant but you should probably use upstream's implementation unless you have a good reason not to (for example, private validators for whom you need a VPC endpoint).