OidcProviderNativeProps Struct

Initialization properties for OidcProviderNative.

Source: aws-eks-v2/lib/oidc-provider.ts
Type last changed: v2.240.0 · 23 Feb 2026

Example

import * as s3 from 'aws-cdk-lib/aws-s3';
// you can import an existing provider
const provider = eks.OidcProviderNative.fromOidcProviderArn(this, 'Provider', 'arn:aws:iam::123456:oidc-provider/oidc.eks.eu-west-1.amazonaws.com/id/AB123456ABC');

// or create a new one using an existing issuer url
declare const issuerUrl: string;
const provider2 = new eks.OidcProviderNative(this, 'Provider', {
  url: issuerUrl,
});

import { KubectlV37Layer } from '@aws-cdk/lambda-layer-kubectl-v37';

const cluster = eks.Cluster.fromClusterAttributes(this, 'MyCluster', {
  clusterName: 'Cluster',
  openIdConnectProvider: provider,
  kubectlProviderOptions: {
    kubectlLayer: new KubectlV37Layer(this, 'kubectl'),
  }});

const serviceAccount = cluster.addServiceAccount('MyServiceAccount');

const bucket = new s3.Bucket(this, 'Bucket');
bucket.grantReadWrite(serviceAccount);

python

import aws_cdk.aws_s3 as s3

# or create a new one using an existing issuer url
# issuer_url: str

from aws_cdk.lambda_layer_kubectl_v37 import KubectlV37Layer

# you can import an existing provider
provider = eks.OidcProviderNative.from_oidc_provider_arn(self, "Provider", "arn:aws:iam::123456:oidc-provider/oidc.eks.eu-west-1.amazonaws.com/id/AB123456ABC")
provider2 = eks.OidcProviderNative(self, "Provider",
    url=issuer_url
)

cluster = eks.Cluster.from_cluster_attributes(self, "MyCluster",
    cluster_name="Cluster",
    open_id_connect_provider=provider,
    kubectl_provider_options=eks.KubectlProviderOptions(
        kubectl_layer=KubectlV37Layer(self, "kubectl")
    )
)

service_account = cluster.add_service_account("MyServiceAccount")

bucket = s3.Bucket(self, "Bucket")
bucket.grant_read_write(service_account)

java

import software.amazon.awscdk.services.s3.*;

// or create a new one using an existing issuer url
String issuerUrl;

import software.amazon.awscdk.cdk.lambdalayer.kubectl.v37.KubectlV37Layer;

// you can import an existing provider
IOidcProvider provider = OidcProviderNative.fromOidcProviderArn(this, "Provider", "arn:aws:iam::123456:oidc-provider/oidc.eks.eu-west-1.amazonaws.com/id/AB123456ABC");
OidcProviderNative provider2 = OidcProviderNative.Builder.create(this, "Provider")
        .url(issuerUrl)
        .build();

ICluster cluster = Cluster.fromClusterAttributes(this, "MyCluster", ClusterAttributes.builder()
        .clusterName("Cluster")
        .openIdConnectProvider(provider)
        .kubectlProviderOptions(KubectlProviderOptions.builder()
                .kubectlLayer(new KubectlV37Layer(this, "kubectl"))
                .build())
        .build());

ServiceAccount serviceAccount = cluster.addServiceAccount("MyServiceAccount");

Bucket bucket = new Bucket(this, "Bucket");
bucket.grantReadWrite(serviceAccount);

csharp

// Install: dotnet add package Amazon.CDK.Lib
using Amazon.CDK.AWS.S3;

// or create a new one using an existing issuer url
string issuerUrl;

using Amazon.CDK.LambdaLayer.KubectlV37;

// you can import an existing provider
var provider = OidcProviderNative.FromOidcProviderArn(this, "Provider", "arn:aws:iam::123456:oidc-provider/oidc.eks.eu-west-1.amazonaws.com/id/AB123456ABC");
var provider2 = new OidcProviderNative(this, "Provider", new OidcProviderNativeProps {
    Url = issuerUrl
});

var cluster = Cluster.FromClusterAttributes(this, "MyCluster", new ClusterAttributes {
    ClusterName = "Cluster",
    OpenIdConnectProvider = provider,
    KubectlProviderOptions = new KubectlProviderOptions {
        KubectlLayer = new KubectlV37Layer(this, "kubectl")
    }
});

var serviceAccount = cluster.AddServiceAccount("MyServiceAccount");

var bucket = new Bucket(this, "Bucket");
bucket.GrantReadWrite(serviceAccount);

// Install: go get github.com/aws/aws-cdk-go/awscdk/v2
import s3 "github.com/aws/aws-cdk-go/awscdk"

// or create a new one using an existing issuer url
var issuerUrl string

import "github.com/cdklabs/awscdk-kubectl-go/kubectlv37"

// you can import an existing provider
provider := eks.OidcProviderNative_FromOidcProviderArn(this, jsii.String("Provider"), jsii.String("arn:aws:iam::123456:oidc-provider/oidc.eks.eu-west-1.amazonaws.com/id/AB123456ABC"))
provider2 := eks.NewOidcProviderNative(this, jsii.String("Provider"), &OidcProviderNativeProps{
	Url: issuerUrl,
})

cluster := eks.Cluster_FromClusterAttributes(this, jsii.String("MyCluster"), &ClusterAttributes{
	ClusterName: jsii.String("Cluster"),
	OpenIdConnectProvider: provider,
	KubectlProviderOptions: &KubectlProviderOptions{
		KubectlLayer: kubectlv37.NewKubectlV37Layer(this, jsii.String("kubectl")),
	},
})

serviceAccount := cluster.AddServiceAccount(jsii.String("MyServiceAccount"))

bucket := s3.NewBucket(this, jsii.String("Bucket"))
bucket.GrantReadWrite(serviceAccount)

Properties

removalPolicyoptionalRemovalPolicyremoval_policyoptionalRemovalPolicyremovalPolicyoptionalRemovalPolicyRemovalPolicyoptionalRemovalPolicyRemovalPolicyoptionalRemovalPolicy= RemovalPolicy.DESTROY#

The removal policy to apply to the OpenID Connect Provider.

urlstringurlstrurlStringUrlstringUrl*stringrequired#

The URL of the identity provider.

notes

The URL must begin with https:// and should correspond to the iss claim in the provider's OpenID Connect ID tokens. Per the OIDC standard, path components are allowed but query parameters are not. Typically the URL consists of only a hostname, like https://server.example.org or https://example.com.

You can find your OIDC Issuer URL by: aws eks describe-cluster --name %cluster_name% --query "cluster.identity.oidc.issuer" --output text

OidcProviderNativeProps Struct ​

Example ​

Properties ​

OidcProviderNativeProps Struct

Example

Properties