> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/continuous-integration/use-harness-ci/secure-harness-ci/aws-oidc-token-plugin.md).

# Generate AWS access tokens from OIDC tokens

The [AWS OIDC plugin](https://github.com/harness-community/drone-aws-oidc) lets you authenticate with AWS services using [OIDC federation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html) instead of long-lived access keys. This is useful in Harness CI pipelines running on Harness Cloud or self-hosted delegates where temporary credentials are preferred.

### Prerequisites <a href="#prerequisites" id="prerequisites"></a>

* An AWS IAM Role configured with a federated identity provider using OIDC.
* OIDC configured in your AWS account (e.g., via IAM Identity Provider).
* The pipeline must be running in a context where Harness can issue an OIDC token (e.g., on a hosted delegate with OIDC enabled).
* The following feature flags must be enabled on your account. Contact [Harness Support](mailto:support@harness.io) to enable them.

  * `CI_ENABLE_OUTPUT_SECRETS` (required)
  * `CI_ENABLE_PLUGIN_OUTPUT_SECRETS` (required only if you use [Harness Docker Runner](/continuous-integration/use-harness-ci/use-harness-ci/set-up-build-infrastructure/define-a-docker-build-infrastructure.md) infrastructure)

  These flags are required for the plugin to write temporary credentials as output secrets. If they are not enabled, credentials will not be available in subsequent steps.
* This setup is supported on both Harness Cloud and Self-managed Kubernetes Infrastructure.

For more on configuring AWS for OIDC, refer to [AWS OIDC setup](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html).

### Example Pipeline Usage <a href="#example-pipeline-usage" id="example-pipeline-usage"></a>

```yaml
- step:
    type: Plugin
    name: assume-role-with-oidc
    identifier: assume_role_with_oidc
    spec:
      image: plugins/aws-oidc
      settings:
        iamRoleArn: arn:aws:iam::123456789012:role/harness-ci-role
        role_session_name: foo # defaults to harness-aws-oidc
        duration: 3600 # in seconds
```

This step uses the injected OIDC token from Harness to authenticate with AWS and assume the specified role. The plugin writes the following temporary credentials as **output variables**:

* `AWS_ACCESS_KEY_ID`
* `AWS_SECRET_ACCESS_KEY`
* `AWS_SESSION_TOKEN`

{% hint style="warning" %}
**IMPORTANT**

The AWS OIDC plugin does **not** export credentials as plain environment variables that are automatically available in subsequent steps. Instead, it writes them as **output secrets**, which you must explicitly reference using Harness output variable expressions. If you attempt to use `AWS_ACCESS_KEY_ID` directly without mapping it through an output variable expression, the credentials will not be available and AWS API calls will fail with errors such as `AuthorizationHeaderMalformed`.
{% endhint %}

### Inputs <a href="#inputs" id="inputs"></a>

| Key               | Required | Description                                                                 |
| ----------------- | -------- | --------------------------------------------------------------------------- |
| `iamRoleArn`      | ✅ Yes    | The ARN of the AWS IAM role to assume via OIDC.                             |
| `oidcTokenId`     | ✅ Yes    | The OIDC token to exchange for temporary AWS credentials.                   |
| `roleSessionName` | ❌ No     | Optional name for the assumed role session. Defaults to `harness-aws-oidc`. |
| `duration`        | ❌ No     | Optional duration (in seconds) for temporary credentials.                   |
| `logLevel`        | ❌ No     | Optional log level (e.g. `debug`, `info`, `warn`).                          |

### Use AWS credentials in subsequent steps <a href="#use-aws-credentials-in-subsequent-steps" id="use-aws-credentials-in-subsequent-steps"></a>

To use the temporary AWS credentials in downstream steps, you must pass them explicitly using Harness output variable expressions in the step's `envVariables` configuration. Replace `assume_role_with_oidc` with the identifier of your AWS OIDC plugin step.

Example:

```yaml
- step:
    type: Run
    name: Run AWS Command
    identifier: runAwsCommand
    spec:
      image: amazon/aws-cli
      shell: sh
      envVariables:
        AWS_ACCESS_KEY_ID: <+steps.assume_role_with_oidc.output.outputVariables.AWS_ACCESS_KEY_ID>
        AWS_SECRET_ACCESS_KEY: <+steps.assume_role_with_oidc.output.outputVariables.AWS_SECRET_ACCESS_KEY>
        AWS_SESSION_TOKEN: <+steps.assume_role_with_oidc.output.outputVariables.AWS_SESSION_TOKEN>
      command: aws s3 ls
```

### Troubleshooting <a href="#troubleshooting" id="troubleshooting"></a>

The following feature flags must be enabled for output secrets to work:

1. `CI_ENABLE_OUTPUT_SECRETS` (required)
2. `CI_ENABLE_PLUGIN_OUTPUT_SECRETS` (required only if you use [Harness Docker Runner](/continuous-integration/use-harness-ci/use-harness-ci/set-up-build-infrastructure/define-a-docker-build-infrastructure.md) infrastructure)

{% hint style="info" %}
If AWS credentials appear empty or null in downstream steps (for example, `AWS_ACCESS_KEY_ID` resolves to an empty string), this is almost always caused by missing feature flags. Verify that `CI_ENABLE_OUTPUT_SECRETS` is enabled on your account. If you are using Docker Runner, also confirm `CI_ENABLE_PLUGIN_OUTPUT_SECRETS` is enabled. Contact [Harness Support](mailto:support@harness.io) before debugging IAM roles or trust policies.
{% endhint %}

### Related Links <a href="#related-links" id="related-links"></a>

[AWS OIDC plugin GitHub Repo](https://github.com/harness-community/drone-aws-oidc)

[Azure OIDC Token Plugin](/continuous-integration/use-harness-ci/secure-harness-ci/azure-oidc-token-plugin.md)

[GCP OIDC Token Plugin](/continuous-integration/use-harness-ci/secure-harness-ci/gcp-oidc-token-plugin.md)