AWS IAM medium security documentation change
Summary
Added documentation about identity-provider controls for OIDC providers requiring explicit JWT claim evaluation and linked to new security controls page
Security assessment
Introduces 'identity-provider controls' requiring explicit evaluation of JWT claims, which addresses potential security risks in OIDC federation by enforcing stricter token validation. This directly relates to security best practices for authentication.
Diff
diff --git a/IAM/latest/UserGuide/id_roles_create_for-idp_oidc.md b/IAM/latest/UserGuide/id_roles_create_for-idp_oidc.md index 02976a400..a9819c274 100644 --- a//IAM/latest/UserGuide/id_roles_create_for-idp_oidc.md +++ b//IAM/latest/UserGuide/id_roles_create_for-idp_oidc.md @@ -157 +157,3 @@ If a user uses a mobile app to sign in from Amazon Cognito, the following exampl -After you complete the prerequisites, you can create the role in IAM. The following procedure describes how to create the role for OIDC federation in the AWS Management Console. To create a role from the AWS CLI or AWS API, see the procedures at [Create a role for a third-party identity provider (federation)](./id_roles_create_for-idp.html). +After you complete the prerequisites, you can create the role in IAM. For recognized shared OpenID Connect (OIDC) identity providers (IdPs), IAM requires explicit evaluation of specific claims in JSON Web Tokens (JWTs) known as _identity-provider controls_. For more information about which OIDC IdPs have _identity-provider controls_ , see [Identity-provider controls for shared OIDC providers](./id_roles_providers_oidc_secure-by-default.html). + +The following procedure describes how to create the role for OIDC federation in the AWS Management Console. To create a role from the AWS CLI or AWS API, see the procedures at [Create a role for a third-party identity provider (federation)](./id_roles_create_for-idp.html). @@ -199 +201,3 @@ If you set or modify a role trust policy for a role associated with the HCP Terr - 5. Enter the identifier for your application. The label of the identifier changes based on the provider you choose: + 5. The requested information varies based on the OIDC provider you choose. + + * Enter the identifier for your application. The label of the identifier changes based on the provider you choose: