aws changedmanage-claude/wif-providers/aws
Nearest release: v2.1.307, published an hour after this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+11added
Lines−11removed
From line
23
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits10to this page, all time
The whole hunk
from line 23, old and new numbered
/
from line 23
2323
2424<Steps>
2525 <Step title="Enable outbound web identity federation for the account">
26 This is an account-level flag, off by default. In the AWS console, open **IAM**, choose **Account settings**, and enable **Outbound web identity federation**. To enable it programmatically:
26 This is an account-level flag, off by default. In the AWS console, open **IAM**, select **Account settings**, and enable **Outbound web identity federation**. To enable it programmatically:
2727
2828 ```bash
2929 python3 -c "import boto3; boto3.client('iam').enable_outbound_web_identity_federation()"
from line 50
5050 </Step>
5151
5252 <Step title="Find your account's STS issuer URL">
53 After enabling outbound federation, the **IAM > Account settings** page shows a **Get Token Issuer URL** field with a value of the form `https://<uuid>.tokens.sts.global.api.aws`. This URL is unique to your AWS account; copy it for the next step. To retrieve it programmatically:
53 After you enable outbound federation, the **IAM > Account settings** page shows a **Get Token Issuer URL** field with a value of the form `https://<uuid>.tokens.sts.global.api.aws`. This URL is unique to your AWS account; copy it for the next step. To retrieve it programmatically:
5454
5555 ```bash
5656 python3 -c "import boto3; print(boto3.client('iam').get_outbound_web_identity_federation_info())"
from line 95
9595
9696### Acquire and use the token
9797
98Call `GetWebIdentityToken` with `https://api.anthropic.com` as the audience, then pass the result to the SDK's federation credentials through `identity_token_provider` (typescript: `identityTokenProvider`; php: `identityProvider`; csharp: `IdentityTokenProvider`; go: `option.WithFederationTokenProvider`; java: `IdentityTokenConfig`). Except in Java (see the comment in that example), that option takes a token provider, so the SDK re-invokes STS on each refresh.
98Call `GetWebIdentityToken` with `https://api.anthropic.com` as the audience, then pass the result to the SDK's federation credentials through `identity_token_provider` (typescript: `identityTokenProvider`; php: `identityProvider`; csharp: `IdentityTokenProvider`; go: `option.WithFederationTokenProvider`; java: `IdentityTokenConfig`). Except in Java (see the comment in that example), that option takes a token provider, so the SDK calls STS again on each refresh.
9999
100100<Note>
101101 `GetWebIdentityToken` is available only on regional STS endpoints. If you receive `'STS' object has no attribute 'get_web_identity_token'` or a similar error, pin your STS client to a region (for example, `boto3.client("sts", region_name="us-east-1")`) and ensure your AWS SDK is recent enough to include the API.
from line 112
112112
113113 ACCESS_TOKEN=$(curl -sS https://api.anthropic.com/v1/oauth/token \
114114 -H "content-type: application/json" \
115 --data @- <<JSON | jq -r .access_token
115 -d @- <<JSON | jq -r .access_token
116116 {
117117 "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer",
118118 "assertion": "$JWT",
from line 371
371371 --duration-seconds 900 \
372372 --query WebIdentityToken --output text > "$ANTHROPIC_IDENTITY_TOKEN_FILE"
373373
374 # ANTHROPIC_FEDERATION_RULE_ID, ANTHROPIC_ORGANIZATION_ID, and
374 # ANTHROPIC_FEDERATION_RULE_ID, ANTHROPIC_ORGANIZATION_ID,
375375 # ANTHROPIC_SERVICE_ACCOUNT_ID, and ANTHROPIC_WORKSPACE_ID are read from the environment
376376 ant messages create \
377377 --model claude-opus-5-5 \
from line 466
466466
467467curl -sS https://api.anthropic.com/v1/oauth/token \
468468 -H "content-type: application/json" \
469 --data @- <<JSON
469 -d @- <<JSON
470470{
471471 "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer",
472472 "assertion": "$JWT",
from line 482
482482
483483## Use EKS projected service-account tokens
484484
485If your workload runs in an EKS pod, you can skip the STS call and read a Kubernetes-projected service-account token directly from disk. Kubernetes natively projects an OIDC-compatible token into the pod, and the SDK can read it from a file path, so no token-provider callable is required. This path has two fewer AWS configuration steps than the STS path but only works inside a pod; the underlying mechanism is the same as the [generic Kubernetes integration](https://platform.claude.com/docs/en/manage-claude/wif-providers/kubernetes).
485If your workload runs in an EKS pod, you can skip the STS call and read a Kubernetes-projected service-account token directly from disk. Kubernetes natively projects an OIDC-compatible token into the pod, and the SDK can read it from a file path. This path has two fewer AWS configuration steps than the STS path but only works inside a pod; the underlying mechanism is the same as the [generic Kubernetes integration](https://platform.claude.com/docs/en/manage-claude/wif-providers/kubernetes).
486486
487487This path additionally requires an EKS cluster with an [IAM OIDC provider enabled](https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html) and `kubectl` access to the cluster.
488488
from line 579
579579
580580The wizard creates these resources for you. Use the following values whether you enter them in the wizard or send them to the [Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api):
581581
582**Federation issuer:** EKS issuers expose a public JWKS endpoint, so use discovery mode. The issuer URL must exactly match the token's `iss` claim. Register one issuer per cluster.
582**Federation issuer:** EKS issuers expose a public JWKS endpoint, so use discovery mode. The issuer URL must exactly match the token's `iss` claim. Register one issuer for each cluster.
583583
584584```json
585585{
from line 618
618618
619619 ACCESS_TOKEN=$(curl -sS https://api.anthropic.com/v1/oauth/token \
620620 -H "content-type: application/json" \
621 --data @- <<JSON | jq -r .access_token
621 -d @- <<JSON | jq -r .access_token
622622 {
623623 "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer",
624624 "assertion": "$JWT",
from line 821
821821
822822curl -sS https://api.anthropic.com/v1/oauth/token \
823823 -H "content-type: application/json" \
824 --data @- <<JSON
824 -d @- <<JSON
825825{
826826 "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer",
827827 "assertion": "$JWT",
from line 846
846846* **Pin the full role ARN:** Use `subject_prefix: "arn:aws:iam::<account>:role/<role-name>"` with no trailing `*` so other roles in the account do not match.
847847* **Pin the account ID:** Match the `aws_account` field of the token's `https://sts.amazonaws.com/` claim with the `claims` map or a CEL `condition` as a defense-in-depth check against a misconfigured prefix.
848848* **Pin namespace and service account on EKS:** Use the exact `system:serviceaccount:<namespace>:<name>` value with no `*` after the `system:serviceaccount:` prefix.
849* **Use a separate rule per environment:** Create distinct rules for production, staging, and development workloads rather than widening one prefix to cover them all.
849* **Use a separate rule for each environment:** Create distinct rules for production, staging, and development workloads rather than widening one prefix to cover them all.
850850
851851## Next steps
852852
No line in this hunk matches that.