We have an Azure Function App using a system-assigned managed identity. Is there a supported way to let that identity upload objects to an Amazon S3 bucket without storing and manually rotating long-lived AWS access keys?
1 Answer
The usual approach is workload identity federation: configure AWS IAM with an OpenID Connect identity provider that trusts tokens issued for the Azure workload, then create an IAM role with only the required S3 permissions. The Function obtains a short-lived token through its managed identity and uses AWS STS AssumeRoleWithWebIdentity to receive temporary credentials. You’ll need to carefully configure the OIDC provider, audience, issuer, and subject conditions in the role trust policy, and restrict the role to the specific bucket and operations it needs.
So I should start with AWS IAM’s OIDC identity-provider and web-identity role documentation, then map the Azure-issued token claims into the trust policy?