OIDC

Buddy supports OIDC for pipeline integration with Amazon cloud services, and SSO login. In this guide you will learn how to configure OIDC for pipelines.

OIDC provider configuration

  1. Sign in to AWS IAM and go to Access ManagementIdentity providers.
  2. Click Add provider.
  3. Switch the type to OpenID Connect and fill in the details:

    • Provider URLhttps://oidc.buddyusercontent.com (US accounts) or https://eu-oidc.buddyusercontent.com (EU accounts)
    • Audiencehttps://app.buddy.works/WORKSPACE_URL_HANDLE or custom

  1. Click Add provider to continue.

Adding new role

  1. Go to Access ManagementRoles and click Create Role.
  2. Switch the type to Web identity, and select the created identity provider and audience:

  1. Proceed to the next step and define the permission policies.
  2. Proceed to the next step and define the role's name, description and tags.
  3. Click Create to add the role, then go to its details and copy the role's ARN.

Buddy configuration

  1. Sign in to your Buddy account and go to Integrations.
  2. Click New integration and select AWS.
  3. Define the integration details:

    • enter the name and define the sharing scope
    • switch the authorization method to OIDC
    • paste the ARN from the AWS role
    • paste the audience from the OIDC provider → https://app.buddy.works/WORKSPACE_URL_HANDLE or custom

  1. Click the button to finish configuration.

Restricting role to integration

To ensure that your AWS role is restricted exclusively to this integration, you must define additional conditions for it.
  1. Go to the created integration in Buddy and copy the Subject.
  2. Switch to AWS and go to the role details.
  3. Switch to the Trust relationships and click Edit trust policy.
  4. Change the condition to the following:
"Condition": {
  "StringEquals": {
    "oidc.buddyusercontent.com:aud": "https://app.buddy.works/WORKSPACE_URL_HANDLE",
    "oidc.buddyusercontent.com:sub": "AWS_INTEGRATION_SUBJECT"
  }
}

Last modified on July 27, 2023

Questions?

Not sure how to configure a pipeline for your process? Reach out on the live-chat or contact support

Get Started

Sign up for free and deploy your project in less than 10 minutes.