AWS IAM outbound identity federation now supports interface VPC endpoints for OIDC discovery

AWS Identity and Access Management (IAM) outbound identity federation now supports Amazon Virtual Private Cloud (VPC) endpoints for OpenID Connect (OIDC) discovery APIs. This allows accessing OIDC discovery metadata and JSON Web Key Set (JWKS) verification key endpoints from within a VPC using AWS PrivateLink, keeping traffic off the public internet. Instead of long-term credentials, workloads request short-lived JSON Web Tokens (JWTs) from AWS Security Token Service (AWS STS); external services validate these tokens using public verification keys and metadata from the OIDC discovery endpoints. Previously, these endpoints were reachable only via the public internet, limiting validation workloads in internet-free VPCs. This release creates interface VPC endpoints to keep verification key traffic within the AWS network, meeting network security requirements for internet-restricted VPCs while still allowing external services to validate JWTs. The feature is available in all commercial AWS regions, AWS GovCloud (US) regions, and China regions at no additional cost beyond standard AWS PrivateLink pricing. For more information, see the IAM user guide.

Why it matters

This update is useful for AWS workloads running in VPCs that need to securely access external services. IAM outbound identity federation allows requesting short-lived tokens without using long-term credentials.