Package software.amazon.awscdk.services.iam

Class OpenIdConnectProvider

java.lang.Object

software.amazon.jsii.JsiiObject

software.constructs.Construct

software.amazon.awscdk.Resource

software.amazon.awscdk.services.iam.OpenIdConnectProvider

All Implemented Interfaces:

IResource, IOpenIdConnectProvider, software.amazon.jsii.JsiiSerializable, software.constructs.IConstruct, software.constructs.IDependable

Direct Known Subclasses:

OpenIdConnectProvider, OpenIdConnectProvider

@Generated(value="jsii-pacmak/1.113.0 (build fc68b25)",
           date="2025-09-02T11:25:32.818Z")
@Stability(Stable)
public class OpenIdConnectProvider
extends Resource
implements IOpenIdConnectProvider

IAM OIDC identity providers are entities in IAM that describe an external identity provider (IdP) service that supports the OpenID Connect (OIDC) standard, such as Google or Salesforce.

You use an IAM OIDC identity provider when you want to establish trust between an OIDC-compatible IdP and your AWS account. This is useful when creating a mobile app or web application that requires access to AWS resources, but you don't want to create custom sign-in code or manage your own user identities.

⚠️ IMPORTANT NOTICE FOR CONTRIBUTORS ⚠️

DO NOT ADD NEW FEATURES TO THIS CONSTRUCT

This construct uses a custom resource with Lambda functions and is maintained for backward compatibility only. We cannot deprecate it due to its usage in existing services like EKS (see https://github.com/aws/aws-cdk/pull/28634#discussion_r1842962697).

For new functionality, developers should use OidcProviderNative instead, which utilizes the native CloudFormation resource AWS::IAM::OIDCProvider and provides the same functionality with less complexity.

If you are considering adding features to this construct, please:

1. Consider implementing the feature in OidcProviderNative instead
2. Discuss with the CDK team before proceeding
3. Ensure any changes maintain strict backward compatibility

Example:

 OpenIdConnectProvider provider = OpenIdConnectProvider.Builder.create(this, "MyProvider")
         .url("https://openid/connect")
         .clientIds(List.of("myclient1", "myclient2"))
         .build();
 

See Also:

• https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_oidc.html

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final class	OpenIdConnectProvider.Builder	A fluent builder for OpenIdConnectProvider.

Nested classes/interfaces inherited from class software.amazon.jsii.JsiiObject

software.amazon.jsii.JsiiObject.InitializationMode

Nested classes/interfaces inherited from interface software.constructs.IConstruct

software.constructs.IConstruct.Jsii$Default

Nested classes/interfaces inherited from interface software.amazon.awscdk.services.iam.IOpenIdConnectProvider

IOpenIdConnectProvider.Jsii$Default, IOpenIdConnectProvider.Jsii$Proxy

Nested classes/interfaces inherited from interface software.amazon.awscdk.IResource

IResource.Jsii$Default

Field Summary

Fields

Modifier and Type	Field	Description
static final String	PROPERTY_INJECTION_ID	Uniquely identifies this class.

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	OpenIdConnectProvider(software.amazon.jsii.JsiiObject.InitializationMode initializationMode)
protected	OpenIdConnectProvider(software.amazon.jsii.JsiiObjectRef objRef)
	OpenIdConnectProvider(software.constructs.Construct scope, String id, OpenIdConnectProviderProps props)	Defines an OpenID Connect provider.

Method Summary

Modifier and Type	Method	Description
static IOpenIdConnectProvider	fromOpenIdConnectProviderArn(software.constructs.Construct scope, String id, String openIdConnectProviderArn)	Imports an Open ID connect provider from an ARN.
String	getOpenIdConnectProviderArn()	The Amazon Resource Name (ARN) of the IAM OpenID Connect provider.
String	getOpenIdConnectProviderIssuer()	The issuer for OIDC Provider.
String	getOpenIdConnectProviderthumbprints()	The thumbprints configured for this provider.

Methods inherited from class software.amazon.awscdk.Resource

applyRemovalPolicy, generatePhysicalName, getEnv, getPhysicalName, getResourceArnAttribute, getResourceNameAttribute, getStack, isOwnedResource, isResource

Methods inherited from class software.constructs.Construct

getNode, isConstruct, toString

Methods inherited from class software.amazon.jsii.JsiiObject

jsiiAsyncCall, jsiiAsyncCall, jsiiCall, jsiiCall, jsiiGet, jsiiGet, jsiiSet, jsiiStaticCall, jsiiStaticCall, jsiiStaticGet, jsiiStaticGet, jsiiStaticSet, jsiiStaticSet

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Methods inherited from interface software.constructs.IConstruct

getNode

Methods inherited from interface software.amazon.awscdk.IResource

applyRemovalPolicy, getEnv, getStack

Methods inherited from interface software.amazon.jsii.JsiiSerializable

$jsii$toJson

Field Details

PROPERTY_INJECTION_ID

@Stability(Stable)
public static final String PROPERTY_INJECTION_ID

Uniquely identifies this class.

Constructor Details

OpenIdConnectProvider

protected OpenIdConnectProvider(software.amazon.jsii.JsiiObjectRef objRef)

OpenIdConnectProvider

protected OpenIdConnectProvider(software.amazon.jsii.JsiiObject.InitializationMode initializationMode)

OpenIdConnectProvider

@Stability(Stable)
public OpenIdConnectProvider(@NotNull
 software.constructs.Construct scope,
 @NotNull
 String id,
 @NotNull
 OpenIdConnectProviderProps props)

Defines an OpenID Connect provider.

Parameters:

scope - The definition scope. This parameter is required.

id - Construct ID. This parameter is required.

props - Initialization properties. This parameter is required.

Method Details

fromOpenIdConnectProviderArn

@Stability(Stable)
@NotNull
public static IOpenIdConnectProvider fromOpenIdConnectProviderArn(@NotNull
 software.constructs.Construct scope,
 @NotNull
 String id,
 @NotNull
 String openIdConnectProviderArn)

Imports an Open ID connect provider from an ARN.

Parameters:

scope - The definition scope. This parameter is required.

id - ID of the construct. This parameter is required.

openIdConnectProviderArn - the ARN to import. This parameter is required.

getOpenIdConnectProviderArn

@Stability(Stable)
@NotNull
public String getOpenIdConnectProviderArn()

The Amazon Resource Name (ARN) of the IAM OpenID Connect provider.

Specified by:

getOpenIdConnectProviderArn in interface IOpenIdConnectProvider

getOpenIdConnectProviderIssuer

@Stability(Stable)
@NotNull
public String getOpenIdConnectProviderIssuer()

The issuer for OIDC Provider.

Specified by:

getOpenIdConnectProviderIssuer in interface IOpenIdConnectProvider

getOpenIdConnectProviderthumbprints

@Stability(Stable)
@NotNull
public String getOpenIdConnectProviderthumbprints()

The thumbprints configured for this provider.