STS AssumeRoleWithWebIdentity Flow

STS AssumeRoleWithWebIdentity Flow A sequence diagram generated by Archify. 1. Request service account token 2. JWT token (projected volume) 3. AssumeRoleWithWebIdentity (JWT + role ARN) 4. Fetch JWKS public keys 5. Public keys → verify signature · iss/aud/sub claims 6. Check trust policy (OIDC condition) 7. Policy approved 8. Temporary credentials (Access Key · Secret Key · Session Token) 9. AWS API call with temporary credentials 10. Response Token issuance Role assumption · token validation · policy evaluation Credentials returned · AWS API call Pod · AWS SDK application · Sequence participant Pod AWS SDK application Kubernetes API · API server issues SA tokens · Sequence participant Kubernetes API API server issues SA tokens OIDC Provider · per-cluster EKS issuer URL · Sequence participant OIDC Provider per-cluster EKS issuer URL AWS STS · token exchange · Sequence participant AWS STS token exchange IAM Role · trust policy · Sequence participant IAM Role trust policy AWS Service · e.g. S3 · Sequence participant AWS Service e.g. S3 Legend request return security default message