AWS OIDC Service Connection

Purpose

The purpose of this page is to give an overview of the AWS IAM service connection setup, and the activities and steps that needs to happen for a Team/namespace to have their pipelines enabled with KaaS AWS.

✅ CURRENT APPROACH: As of July 2025, this is the standard authentication method for all KaaS AWS integrations, replacing legacy IAM User static credentials.

Authenticating Azure DevOps Pipelines to AWS using AWS OIDC Service Connection

Overview

The AWS Toolkit for Azure DevOps, which is already installed at the organization level, provides a service connection that allows build and release pipelines to interact with AWS services (e.g., S3, DynamoDB, etc) without relying on static credentials. Instead, this service connection uses OpenID Connect (OIDC) for authentication, which relies on a trust relationship between the system and specific principal within it (a service connection in Azure DevOps) and AWS, to issue temporary access keys.

How It Works

1. AWS Toolkit for Azure DevOps: The toolkit, installed at the organization level, provides service connections that authenticate with AWS using OIDC, and ADO tasks that can utilize this service connection to request and provide temporary credentials for pipelines.
2. OIDC Token: During pipeline execution, Azure DevOps issues an OIDC token through the service connection.
3. Assume Role: AWS uses this token to assume a predefined IAM role, granting temporary, session-specific access to AWS resources.
4. Temporary Credentials: These credentials expire after the session, ensuring they cannot be reused or abused outside the pipeline context.

Benefits

• Increased Security: OIDC eliminates the need for static AWS access keys, reducing the risk of key exposure and long-term credential abuse.
• Reduced Operational Overhead: By using temporary tokens, teams avoid the hassle of managing and rotating static credentials.
• Federated Access: OIDC enables seamless authentication between Azure DevOps and AWS through a trusted relationship, making permission management easier across systems.

By utilizing the AWS Toolkit’s service connection, the organization ensures secure and efficient access to AWS services during pipeline executions.

DevX has created some automations and documentation regarding how to set the service connection up. This is found in the service catalogue documentation here

As a Prerequisite, Azure DevOps needs to be configured as an identity provider on our AWS account in the IAM Console, which is further explained in the AWS configuration guide

KaaS pipeline implementation

The service connection is used in the "spin up agent" template of "pipeline-agent" Git repo, which is used in confluent-resources-template for accessing AWS.

As seen in the below code example, the service connection is accessed via an AWS Toolkit task that uses the service connection to get temporary access credentials for a Bash shell. The Bash shell then passes the temporary credentials on to subsequent pipeline steps and jobs in the same stage. Subsequent stages generate new credentials since the credentials may expire between stages.

  - task: AWSShellScript@1
    displayName: "Assume AWS IAM Role using OIDC"
    inputs:
      AWS.RoleSessionName: $(System.JobId)
      awsCredentials: 'kaas-$(confluentOrganization)-ns-$(namespace)-deploy'  # Your AWS service connection
      regionName: '$(aws-region)'                    # Your AWS region
      scriptType: 'inline'                          # Inline shell script
      inlineScript: |
        # Set variables with temporary AWS credentials for the same job
        echo "##vso[task.setvariable variable=AWS_ACCESS_KEY_ID;issecret=true]$AWS_ACCESS_KEY_ID"
        echo "##vso[task.setvariable variable=AWS_SECRET_ACCESS_KEY;issecret=true]$AWS_SECRET_ACCESS_KEY"
        echo "##vso[task.setvariable variable=AWS_SESSION_TOKEN;issecret=true]$AWS_SESSION_TOKEN"

        # Set variables with temporary AWS credentials for subsequent jobs
        echo "##vso[task.setvariable variable=AWS_ACCESS_KEY_ID;isOutput=true;issecret=true]$AWS_ACCESS_KEY_ID"
        echo "##vso[task.setvariable variable=AWS_SECRET_ACCESS_KEY;isOutput=true;issecret=true]$AWS_SECRET_ACCESS_KEY"
        echo "##vso[task.setvariable variable=AWS_SESSION_TOKEN;isOutput=true;issecret=true]$AWS_SESSION_TOKEN"
    name: getCredentialsStep

KaaS Team Onboarding - Platform team actions

To onboard a team, we as a platform team need to configure an IAM role on our AWS account(s).

We set up this manually by following the steps outlined in AWS Configuration Guide under Service Accounts (Team AWS IAM Role)

Team Onboarding - Team Project Administrator actions

A project administrator on the Azure DevOps project associated with the team being onboarded, needs to set up the AWS service connection in their project, which correctly points to our configured AWS account and IAM Role.

The steps to do this are described in the DevX documentation here: Service Connection

They will need the following parameters below

Note: manually replace all occurrences of {{TEAM_NAME}} in the below input parameters with the name of the team

Note for onboarding to preprod: replace all occurrences of 941447692616 (PROD aws account ID) with 898692020956 (VAL/PREPROD AWS account ID), and replaces all occurrences of 'prod' with 'preprod'

Role to Assume: arn:aws:iam::941447692616:role/kaas-prod-ns-{{TEAM_NAME}}-deploy

Service connection name: kaas-prod-ns-{{TEAM_NAME}}-deploy