AWS Application Load Balancer JWT Trust Provider now available
Aembit now offers an AWS Application Load Balancer JWT Trust Provider.
It validates the signed x-amzn-oidc-data token that an AWS Application Load Balancer (ALB) forwards to your workloads
after the ALB authenticates a user session with OpenID Connect (OIDC).
Use this Trust Provider instead of the OIDC ID Token Trust Provider when your workloads sit behind an ALB that authenticates users. ALB tokens require the AWS Application Load Balancer JWT Trust Provider.
Aembit resolves the signing key at validation time rather than from a preconfigured key set. It reads the AWS region and key ID from the token, validates the region before it contacts AWS, then retrieves and caches the matching regional public key. Aembit rotates those keys for you, so your workload only forwards the token.
What’s new:
- AWS Application Load Balancer JWT Trust Provider type: Select the type and add your match rules. The type has no configuration fields of its own, so you don’t set a region or upload a signing key.
- Match rules on ALB token claims: Authorize on
aud,iss,sub, andemail, or on any additional claim your identity provider forwards through the ALB usingcustom_claim. You can add more than onecustom_claimrule to a single Trust Provider. - Terraform support: Manage the Trust Provider through the Aembit Terraform Provider with the
aembit_trust_providerresource.
This Trust Provider works with Aembit Edge. Agent Controller support isn’t available yet.
For the match rule attributes, configuration steps, and troubleshooting, see AWS Application Load Balancer JWT Trust Provider.