AWS OIDC Plugin Should Support Custom JWT Claims And AWS Session Tags To Enable Migration From The Legacy OIDC Token API
G
Given Gecko
Description
Customers using the legacy AWS OIDC Token API can inject custom JWT claims and configure OIDC session tags (oidcSessionTagKeys) to satisfy AWS IAM Trust Policies and Attribute-Based Access Control (ABAC).
The recommended migration path is to use the AWS OIDC Plugin, but it currently does not provide equivalent functionality.
Today, the plugin receives a JWT that has already been generated by Harness and simply forwards it to AWS STS via AssumeRoleWithWebIdentity. There is no supported way to:
- Add custom JWT claims before the token is signed.
- Configure oidcSessionTagKeys.
- Include AWS-compatible session tag claims in the generated token.
We also investigated using the AWS OIDC connector with the session tag feature enabled and using tje connector-generated OIDC token directly (<+connectorInputs.get(<+infra.connectorRef>).oidcToken>) and manually calling AssumeRoleWithWebIdentity, but that token likewise does not include customer-defined claims or session-tag information.
Why this matters
Many customers rely on custom claims and session tags to:
- Satisfy AWS IAM Trust Policies.
- Implement AWS Attribute-Based Access Control (ABAC).
- Restrict access based on pipeline, environment, or other deployment context.
Without feature parity, customers cannot migrate from the legacy API to the recommended AWS OIDC Plugin without redesigning their existing AWS IAM architecture.
Requested enhancement
Provide migration parity by allowing customers to configure:
- Custom JWT claims.
- oidcSessionTagKeys.
- AWS-compatible session-tag claims before the JWT is signed by Harness.
Log In