AWS IAM Identity Federation Adds Support for VPC Interface Endpoints in OIDC Discovery

AWS expanded IAM outbound identity federation by allowing OpenID Connect discovery endpoints to be accessed over private VPC interface endpoints, enhancing security for workloads without public internet access.

By Clara Morgan · Editorial pseudonym · 2026-09-25 · 1 min read

AI-ASSISTED REPORTING · RETROSPECTIVE ARCHIVE

Retrospective edition: 2026-09-25. Source published: 2026-09-25. Added to this archive: 2026-11-03. This briefing was prepared later from the linked announcement; it was not published on this website on the historical edition date.

Before this update, IAM federation clients required public internet access to retrieve OIDC discovery metadata and JSON Web Key Sets (JWKS) for token verification. With VPC interface endpoint support via AWS PrivateLink, verification key retrieval can occur entirely within an AWS Virtual Private Cloud, eliminating exposure to public networks.

This private connectivity aids compliance with strict network security policies for workloads running in isolated VPCs while maintaining functionality for verifying JSON Web Tokens issued by AWS STS during outbound federation to external services. The feature is available across AWS commercial, GovCloud, and China regions with no additional cost beyond standard PrivateLink fees.

Source & further reading

AWS IAM outbound identity federation now supports interface VPC endpoints for OIDC discovery ↗

Source published 2026-09-25. This report was prepared with AI assistance from the linked primary-source material. Claims and limitations should be checked against the original announcement or research.