Ctrlk
Sign up for FreeKnowledge Base
For the complete documentation index, see llms.txt. This page is also available as Markdown.

AWS OIDC

Install the AWS OIDC federation component so P0 can grant and revoke AWS access for OIDC-authenticated agents running through the P0 AI Gateway.

The AWS OIDC integration lets P0 grant and revoke AWS access for OIDC-authenticated agents. It registers an OIDC identity provider in your AWS account and provisions the IAM roles that P0 assumes on the agent's behalf, so an agent reaching AWS through the P0 AI Gateway gets short-lived, policy-scoped access with no long-lived credentials.

This component exists specifically to enable agentic access to AWS through the gateway. The OIDC provider you register here is the gateway's own identity: the gateway signs a web-identity token, and AWS trusts it via the provider and role pool this component creates.

This component supports only agentic access via the P0 AI Gateway. It's a prerequisite for the AWS MCP server.

Prerequisites

  • The base AWS integration with IAM management installed on the same AWS account. AWS OIDC builds on that integration's IAM-write access, and the account picker only lists accounts where it's already installed.

  • A deployed P0 AI Gateway. The OIDC provider URL and Audience you enter in the following fields come from your gateway deployment. See Deploying the P0 AI Gateway.

  • Permission to apply Terraform (or run the equivalent aws iam commands) in the target AWS account, to create an OIDC provider and IAM roles.

Install the OIDC federation component

  1. Navigate to Integrations on p0.app, select AWS OIDC, and choose the OIDC federation component.

AWS OIDC integration page showing the OIDC federation component, not installed

  1. Click Add identity provider.

OIDC federation page with an empty list of installed identity providers and an Add identity provider button

  1. Fill in the identity provider details, then click Next:

Form for installing a new identity provider with fields for identifier, AWS account ID, OIDC provider URL, and audience

  • Identity provider identifier: a name for this identity provider within P0 (for example, the name of the gateway environment it serves).

  • AWS account ID: the account to install into. The dropdown lists the accounts where the base AWS integration's IAM management is installed.

  • OIDC provider URL: the issuer (iss) URL of your OIDC provider. For the P0 AI Gateway, this is the gateway's OIDC issuer URL.

  • Audience: the aud claim the identity presents to AWS. For the P0 AI Gateway, this is the gateway's configured token audience.

For the P0 AI Gateway, the OIDC provider URL and Audience are typically the same value: the public address of your deployed gateway.

  1. P0 generates a Terraform configuration. Copy it into your Terraform project, apply it, then click Next.

Terraform tab showing generated configuration that registers an AWS IAM OpenID Connect provider

The generated configuration registers the OIDC provider and provisions the IAM roles P0 uses to grant access.

  1. Review the read-only summary and click Finish.

Read-only confirmation of the AWS account ID, OIDC provider URL, and audience with a Finish button

  1. The identity provider now appears with the state Installed.

Installed identity providers list showing the new provider with state Installed

How it works

When an agent requests AWS access through the gateway, P0 attaches temporary, policy-scoped permissions to one of the pre-provisioned IAM roles and conditions them on the agent's identity (sub) and audience (aud). The gateway signs a web-identity token and calls sts:AssumeRoleWithWebIdentity to assume the role. P0 never issues long-lived AWS credentials to the agent, and removes the grant when the session ends or the agent relinquishes it.

Next steps

  • Configure the AWS MCP server to expose AWS to agents behind the gateway, using this OIDC identity as its credential provider.

PreviousAWS Integration APINextFunction invocation

Last updated