OIDC

Buddy supports OIDC for pipeline integration with Amazon cloud services, and SSO login. In this guide you will learn how to configure OIDC for pipelines.

OIDC provider configuration

1. Sign in to AWS IAM and go to Access Management → Identity providers.
2. Click Add provider.

3. Switch the type to OpenID Connect and fill in the details:

   • Provider URL → https://oidc.buddyusercontent.com (US accounts) or https://eu-oidc.buddyusercontent.com (EU accounts)
   • Audience → https://app.buddy.works/WORKSPACE_URL_HANDLE or custom

4. Click Add provider to continue.

Adding new role

1. Go to Access Management → Roles and click Create Role.
2. Switch the type to Web identity, and select the created identity provider and audience:

3. Proceed to the next step and define the permission policies.
4. Proceed to the next step and define the role's name, description and tags.
5. Click Create to add the role, then go to its details and copy the role's ARN.

Buddy configuration

1. Sign in to your Buddy account and go to Integrations.
2. Click New integration and select AWS.

3. Define the integration details:

   • enter the name and define the sharing scope
   • switch the authorization method to OIDC
   • paste the ARN from the AWS role
   • paste the audience from the OIDC provider → https://app.buddy.works/WORKSPACE_URL_HANDLE or custom

4. Click the button to finish configuration.

Restricting role to integration

1. Go to the created integration in Buddy and copy the Subject.
2. Switch to AWS and go to the role details.
3. Switch to the Trust relationships and click Edit trust policy.
4. Change the condition to the following:

"Condition": {
  "StringEquals": {
    "oidc.buddyusercontent.com:aud": "https://app.buddy.works/WORKSPACE_URL_HANDLE",
    "oidc.buddyusercontent.com:sub": "AWS_INTEGRATION_SUBJECT"
  }
}