Changelog — Trust Provider New features

Google Cloud Identity-Aware Proxy (IAP) JWT Trust Provider now available

August 19, 2026

Aembit now offers a Google Cloud Identity-Aware Proxy (IAP) JWT Trust Provider. It validates the signed x-goog-iap-jwt-assertion token that IAP forwards to your workloads on Google Kubernetes Engine (GKE), Cloud Run, and App Engine after IAP authenticates a user.

Use this Trust Provider instead of the OIDC ID Token Trust Provider when IAP authenticates users in front of your workloads. IAP issues signed JWTs, but they aren’t standard OpenID Connect (OIDC) ID tokens. Google publishes the IAP signing keys at a static JWKS endpoint with no discovery document, and the audience identifies a Google Cloud resource rather than an OIDC client ID.

Aembit resolves Google’s signing key at validation time rather than from a preconfigured key set. It reads the key ID from the token, then retrieves the matching public key from Google’s IAP key endpoint. Aembit caches that key in memory, so your workload only forwards the token.

What’s new:

GCP IAP JWT Trust Provider type: Supply the IAP audience that identifies the Google Cloud resource IAP protects. Aembit pins the issuer and resolves the signing keys, so you don’t upload a key or enter a discovery URL.
Match rules on IAP token claims: Authorize on aud, iss, sub, and email, or on any additional claim IAP signs using custom_claim. The aud attribute supports wildcards, so one rule can cover more than one backend service in the same project.
Terraform support: Manage the Trust Provider through the Aembit Terraform provider with the aembit_trust_provider resource.

This Trust Provider validates the user identity that IAP asserts. To validate the identity of a workload running in Google Cloud, use the GCP Identity Token Trust Provider instead.

For the audience formats, match rule attributes, and configuration steps, see Google Cloud Identity-Aware Proxy (IAP) JWT Trust Provider.

Tags:

AWS Application Load Balancer JWT Trust Provider now available

August 5, 2026

Aembit now offers an AWS Application Load Balancer JWT Trust Provider. It validates the signed x-amzn-oidc-data token that an AWS Application Load Balancer (ALB) forwards to your workloads after the ALB authenticates a user session with OpenID Connect (OIDC).

Use this Trust Provider instead of the OIDC ID Token Trust Provider when your workloads sit behind an ALB that authenticates users. ALB tokens require the AWS Application Load Balancer JWT Trust Provider.

Aembit resolves the signing key at validation time rather than from a preconfigured key set. It reads the AWS region and key ID from the token, validates the region before it contacts AWS, then retrieves and caches the matching regional public key. Aembit rotates those keys for you, so your workload only forwards the token.

What’s new:

AWS Application Load Balancer JWT Trust Provider type: Select the type and add your match rules. The type has no configuration fields of its own, so you don’t set a region or upload a signing key.
Match rules on ALB token claims: Authorize on aud, iss, sub, and email, or on any additional claim your identity provider forwards through the ALB using custom_claim. You can add more than one custom_claim rule to a single Trust Provider.
Terraform support: Manage the Trust Provider through the Aembit Terraform Provider with the aembit_trust_provider resource.

This Trust Provider works with Aembit Edge. Agent Controller support isn’t available yet.

For the match rule attributes, configuration steps, and troubleshooting, see AWS Application Load Balancer JWT Trust Provider.

Tags:

AWS Role Trust Provider now available

June 4, 2024

Aembit has released an update to support AWS Role-Based Trust Providers.

The ability to create and use different types of Trust Providers in your Aembit environment enables you to have flexibility in how resources are managed. With this enhancement, you now have an additional option when selecting a Trust Provider.

For more information on AWS Role-Based Trust Providers, please see the AWS Role Trust Provider page.

Tags:

Kerberos Trust Provider now available for Active Directory

March 12, 2024

Aembit has released a Kerberos Trust Provider that enables the attestation of Client Workloads running in virtual machine environments joined to Active Directory. This attestation method is specifically designed for on-premise deployments where alternative attestation methods, such as AWS or Azure metadata service trust providers, are not available.

For more detailed information on this Kerberos Trust Provider, please refer to the Kerberos Trust Provider technical documentation.

Tags: