This update enables administrators to include identity provider-specific claims from Google, GitHub, CircleCI, and OCI in IAM trust policies, allowing fine-grained permission control when federating identities via the AssumeRoleWithWebIdentity API. By referencing these custom claims as condition keys, organizations can enforce stricter security perimeters and tailored authorization.
Building on existing OIDC federation capabilities, this feature improves granularity in policy enforcement for temporary AWS credentials assigned to users authenticated externally. Deployment requires policy updates but does not alter core authentication flows. Independent validation of policy management complexity or security impact has yet to be published.
Source & further reading
AWS STS now supports validation of select identity provider specific claims from Google, GitHub, CircleCI and OCI ↗Source published 2026-02-02. This report was prepared with AI assistance from the linked primary-source material. Claims and limitations should be checked against the original announcement or research.