AWS EKS

Amazon EKS issues OIDC tokens for Kubernetes service accounts. Each cluster has its own issuer. The subject is system:serviceaccount:<namespace>:<name>. EC2 and Lambda do not issue these tokens.

Docs and discovery


Docs	IAM roles for service accounts
Issuer	`https://oidc.eks.<region>.amazonaws.com/id/<id>`
Discovery	`<issuer>/.well-known/openid-configuration`

The issuer is in the EKS console, your cluster, Overview, OpenID Connect provider URL.

Token


Issuer	The cluster OIDC URL
Audience	The audience in the pod's projected service-account token
Subject	`system:serviceaccount:<namespace>:<name>`

Fields

Field	Claim	Required	Validation
Cluster OIDC issuer URL	`iss`	Yes	`https` URL with no query or fragment.
Namespace	`sub`	Yes	Lowercase letters, digits, and hyphens.
Service account	`sub`	Yes	Same pattern as namespace.
Audience	`aud`	Yes	The audience in the projected token.
Additional claims	other	No	Cannot reuse `aud` or `sub`.

Example policy

{
  issuer: "https://oidc.eks.us-east-1.amazonaws.com/id/EX",
  claims: {
    aud: ["https://app.example.com"],
    sub: ["system:serviceaccount:default:deploy-bot"],
  },
}

Edit components/oidc/provider-aws.tsx after install. For a one-off claim, use Additional claims. For its own input, add it to Fields (or schema), DEFAULTS, compile, parse, FIRST_CLASS_CLAIMS, and the form.

See Add a field.