📦AWS OIDC

Install the AWS OIDC federation component so P0 can grant and revoke AWS access for OIDC-authenticated agents running through the P0 AI Gateway.

The AWS OIDC integration lets P0 grant and revoke AWS access for OIDC-authenticated agents. It registers an OIDC identity provider in your AWS account and provisions the IAM roles that P0 assumes on the agent's behalf, so an agent reaching AWS through the P0 AI Gateway gets short-lived, policy-scoped access with no long-lived credentials.

This component exists specifically to enable agentic access to AWS through the gateway. The OIDC provider you register here is the gateway's own identity: the gateway signs a web-identity token, and AWS trusts it via the provider and role pool this component creates.

This component supports only agentic access via the P0 AI Gateway. It's a prerequisite for the AWS MCP server.

Prerequisites

• The base AWS integration with IAM management installed on the same AWS account. AWS OIDC builds on that integration's IAM-write access, and the account picker only lists accounts where it's already installed.

• A deployed P0 AI Gateway. The OIDC provider URL and Audience you enter below both derive from that deployment's own URL, so install this component after the gateway. See Deploying the P0 AI Gateway.

• Permission to apply Terraform (or run the equivalent aws iam commands) in the target AWS account, to create an OIDC provider and IAM roles.

Install the OIDC federation component

1. Navigate to Integrations on p0.app, select AWS OIDC, and choose the OIDC federation component.

1. Click Add identity provider.

1. Fill in the identity provider details, then click Next:

• Identity provider identifier: a name for this identity provider within P0 (for example, the name of the gateway environment it serves).

• AWS account ID: the account to install into. The dropdown lists the accounts where the base AWS integration's IAM management is installed.

• Audience: the aud claim the identity presents to AWS. This is the gateway's configured token audience, which defaults to that same gateway URL plus /mcps.

• OIDC provider URL: your gateway's OIDC issuer URL, which is the gateway's public base URL.

Where to find your gateway's OIDC issuer

It's your gateway's public base URL, with the https:// scheme and no trailing slash or path: the same value as gatewayIss in the Terraform that deployed the gateway. It has to match the iss claim your gateway puts in the tokens it mints.

• P0-hosted domain: P0 generated the hostname for you and shows it during the gateway install, on the LoadBalancer address step, in the line "P0 will automatically create the DNS record for …". The console displays a bare hostname there, so enter it as https://<hostname>.

• Self-hosted domain: the Agentic gateway URL you entered when you installed the gateway.

The OIDC provider URL and Audience are separate values. The OIDC provider URL is the issuer (iss) of the tokens your gateway mints. The Audience is the aud claim those tokens carry. P0 derives the trust-policy condition key from the provider URL (host and path) and matches the aud condition against the Audience you enter.

1. P0 generates a Terraform configuration. Copy it into your Terraform project, apply it, then click Next.

The generated configuration registers the OIDC provider and provisions the IAM roles P0 uses to grant access.

1. Review the read-only summary and click Finish.

1. The identity provider now appears with the state Installed.

How it works

When an agent requests AWS access through the gateway, P0 attaches temporary, policy-scoped permissions to one of the pre-provisioned IAM roles and conditions them on the token's subject (sub). The audience (aud) isn't checked at this step. It's enforced by the trust policy on the pre-provisioned roles, created by the Terraform you apply when installing this component. The gateway signs a web-identity token and calls sts:AssumeRoleWithWebIdentity to assume the role. P0 never issues long-lived AWS credentials to the agent, and removes the grant when the session ends or the agent relinquishes it.

The sub changes with every session and caller, so don't condition on a fixed value. To scope a role to one MCP server, match the stable prefix (<audience>/<mcp-server-id>/*) with StringLike.

Next steps

• Configure the AWS MCP server to expose AWS to agents behind the gateway, using this OIDC identity as its credential provider.