We have an Azure Function using a system-assigned managed identity. Can that identity be trusted by AWS so the function can upload objects to an Amazon S3 bucket without storing and manually rotating access keys? If so, what setup is required on the Azure and AWS sides?
1 Answer
Yes. The usual approach is to use federated identity with OpenID Connect (OIDC). Configure Azure to issue tokens for the managed identity, register Azure as an OIDC identity provider in AWS IAM, and create an IAM role with a trust policy that accepts only the intended Azure identity. Grant that role the minimum S3 permissions needed, such as uploading objects to a specific bucket and prefix. The Function can then obtain a token through its managed identity and exchange it with AWS STS for temporary role credentials, avoiding long-lived keys and manual rotation.
So the AWS side is based on an IAM OIDC identity provider and a role trust policy, rather than creating an IAM user? I’ll look into the OIDC provider and web-identity role-assumption documentation.