> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/integrations/resource-integrations/aws/aws-oidc.md).

# AWS OIDC

The **AWS OIDC** integration lets P0 grant and revoke AWS access for OIDC-authenticated agents. It registers an OIDC identity provider in your AWS account and provisions the IAM roles that P0 assumes on the agent's behalf, so an agent reaching AWS through the [P0 AI Gateway](/readme/agentic-control-plane.md) gets short-lived, policy-scoped access with no long-lived credentials.

This component exists specifically to enable **agentic access to AWS through the gateway**. The OIDC provider you register here is the gateway's own identity: the gateway signs a web-identity token, and AWS trusts it via the provider and role pool this component creates.

{% hint style="info" %}
This component supports only agentic access via the P0 AI Gateway. It's a prerequisite for the [AWS MCP server](/integrations/resource-integrations/agentic-gateway/mcp-server/aws.md).
{% endhint %}

## Prerequisites

* The base [AWS integration](/integrations/resource-integrations/aws.md) with **IAM management** installed on the same AWS account. AWS OIDC builds on that integration's IAM-write access, and the account picker only lists accounts where it's already installed.
* A deployed P0 AI Gateway. The **OIDC provider URL** and **Audience** you enter in the following fields come from your gateway deployment. See [Deploying the P0 AI Gateway](/getting-started/deploying-the-p0-mcp-gateway.md).
* Permission to apply Terraform (or run the equivalent `aws iam` commands) in the target AWS account, to create an OIDC provider and IAM roles.

## Install the OIDC federation component

1. Navigate to **Integrations** on [p0.app](https://p0.app), select **AWS OIDC**, and choose the **OIDC federation** component.

<figure><img src="/files/gr53G4USrDS1fyhTb2T4" alt="AWS OIDC integration page showing the OIDC federation component, not installed"><figcaption></figcaption></figure>

2. Click **Add identity provider**.

<figure><img src="/files/Rws69Ce9ls7zcaHnmO6d" alt="OIDC federation page with an empty list of installed identity providers and an Add identity provider button"><figcaption></figcaption></figure>

3. Fill in the identity provider details, then click **Next**:

<figure><img src="/files/K1TSZ68yQMtoU7wuhbJu" alt="Form for installing a new identity provider with fields for identifier, AWS account ID, OIDC provider URL, and audience"><figcaption></figcaption></figure>

* **Identity provider identifier**: a name for this identity provider within P0 (for example, the name of the gateway environment it serves).
* **AWS account ID**: the account to install into. The dropdown lists the accounts where the base AWS integration's IAM management is installed.
* **OIDC provider URL**: the issuer (`iss`) URL of your OIDC provider. For the P0 AI Gateway, this is the gateway's OIDC issuer URL.
* **Audience**: the `aud` claim the identity presents to AWS. For the P0 AI Gateway, this is the gateway's configured token audience.

{% hint style="info" %}
The **OIDC provider URL** and **Audience** are separate values. The OIDC provider URL is the issuer (`iss`) of the tokens your gateway mints; the Audience is the `aud` claim those tokens carry. P0 derives the trust-policy condition key from the provider URL (host and path) and matches the `aud` condition against the Audience you enter.
{% endhint %}

4. P0 generates a Terraform configuration. Copy it into your Terraform project, `apply` it, then click **Next**.

<figure><img src="/files/xloAC4WIrzZ8xaYEp2NL" alt="Terraform tab showing generated configuration that registers an AWS IAM OpenID Connect provider"><figcaption></figcaption></figure>

The generated configuration registers the OIDC provider and provisions the IAM roles P0 uses to grant access.

5. Review the read-only summary and click **Finish**.

<figure><img src="/files/n3pybIdu5OtbaHRnFsdg" alt="Read-only confirmation of the AWS account ID, OIDC provider URL, and audience with a Finish button"><figcaption></figcaption></figure>

6. The identity provider now appears with the state **Installed**.

<figure><img src="/files/TGlPFAxjBZY4UjVyxzAo" alt="Installed identity providers list showing the new provider with state Installed"><figcaption></figcaption></figure>

## How it works

When an agent requests AWS access through the gateway, P0 attaches temporary, policy-scoped permissions to one of the pre-provisioned IAM roles and conditions them on the agent's identity (`sub`). The audience (`aud`) isn't checked at this step; it's enforced by the trust policy on the pre-provisioned roles, created by the Terraform you apply when installing this component. The gateway signs a web-identity token and calls `sts:AssumeRoleWithWebIdentity` to assume the role. P0 never issues long-lived AWS credentials to the agent, and removes the grant when the session ends or the agent relinquishes it.

## Next steps

* Configure the [AWS MCP server](/integrations/resource-integrations/agentic-gateway/mcp-server/aws.md) to expose AWS to agents behind the gateway, using this OIDC identity as its credential provider.