AWS IAM: OIDC JWKS must not expose private/symmetric keys; remediation steps
Summary
Adds a note that OpenID Connect Discovery requires the JWKS at jwks_uri to contain no private or symmetric key material (RSA d/p/q/dp/dq/qi/oth, EC d, oct k), that AWS STS returns InvalidIdentityToken for such JWKS, and gives remediation steps: rotate the key pair, remove the exposed key, review CloudTrail AssumeRoleWithWebIdentity events, and revoke active role sessions.
Security assessment
The change addresses a concrete weakness: publishing private/symmetric key material in an OIDC provider's JWKS, which would let an attacker forge tokens accepted by AssumeRoleWithWebIdentity. It explicitly instructs treating the key as compromised, rotating keys, auditing CloudTrail, and revoking sessions, so it is both incident-remediation guidance and security documentation.
Evidence
+You must treat any private key that you published as compromised. Republishing a clean JWKS alone is not sufficient. To remediate this exposure, complete the following steps:
Diff
diff --git a/IAM/latest/UserGuide/id_roles_providers_create_oidc.md b/IAM/latest/UserGuide/id_roles_providers_create_oidc.md index f638a23..478a6fe 100644 --- a//IAM/latest/UserGuide/id_roles_providers_create_oidc.md +++ b//IAM/latest/UserGuide/id_roles_providers_create_oidc.md @@ -53,0 +54,16 @@ The JSON Web Key Set (JWKS) must contain at least one key and can have a maximum +###### Note + +[OpenID Connect Discovery on the OpenID Foundation website](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata) requires that the JSON Web Key Set (JWKS) at `jwks_uri` must not contain private or symmetric key values. Your JWKS must not include the RSA `d`, `p`, `q`, `dp`, `dq`, `qi`, or `oth` parameters, the elliptic curve `d` parameter, or the `k` parameter of a symmetric (`oct`) key. + +If your JWKS contains any of these values, AWS STS returns an `InvalidIdentityToken` exception when you use the AssumeRoleWithWebIdentity API operation. The exception message is "Couldn't retrieve verification key from your identity provider, please reference AssumeRoleWithWebIdentity documentation for requirements". AWS STS also returns this message for other key retrieval failures. + +You must treat any private key that you published as compromised. Republishing a clean JWKS alone is not sufficient. To remediate this exposure, complete the following steps: + + * Generate a new key pair and configure your identity provider to sign tokens with the new key ID (`kid`). + + * Remove the exposed key from your JWKS. + + * Review your AWS CloudTrail `AssumeRoleWithWebIdentity` events for the period when your JWKS exposed the private key. + + * Revoke active sessions for roles that trust the provider. For more information, see [Revoke IAM role temporary security credentials](./id_roles_use_revoke-sessions.html). +