# Federating Amazon identities across Amazon partitions
<a name="id_roles_providers_outbound_cross_partition"></a>

Cross-partition identity federation allows a workload to obtain short-lived access across [Amazon partitions](https://docs.amazonaws.cn/whitepapers/latest/aws-fault-isolation-boundaries/partitions.html). Amazon partitions are hard isolation boundaries with independent instances of Amazon Identity and Access Management (IAM), so a credential issued in one partition isn't valid in another. As a result, direct role assumption with the [AssumeRole](https://docs.amazonaws.cn/STS/latest/APIReference/API_AssumeRole.html) API doesn't work across partition boundaries.

Cross-partition identity federation works as a two-step exchange: your workload calls [sts:GetWebIdentityToken](https://docs.amazonaws.cn/STS/latest/APIReference/API_GetWebIdentityToken.html) to obtain a short-lived JSON Web Token (JWT) from [Amazon Security Token Service (STS)](https://docs.amazonaws.cn/STS/latest/APIReference/Welcome.html) in the source partition. It then calls [sts:AssumeRoleWithWebIdentity](https://docs.amazonaws.cn/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html) to exchange the token for temporary credentials in the destination partition. This approach lets the workload use temporary credentials in both partitions, following the IAM best practice of [using temporary credentials for workloads](best-practices.md#bp-workloads-use-roles).

**Note**  
Cross-partition identity federation is available in the commercial Amazon Regions (`aws`), the China Regions (`aws-cn`), the Amazon GovCloud (US) Regions (`aws-us-gov`), and the Amazon European Sovereign Cloud (`aws-eusc`).
The destination role must be in a different Amazon partition from the one where the token was issued. The JWTs from `GetWebIdentityToken` cannot be used for OpenID Connect (OIDC) federation into the same partition through `AssumeRoleWithWebIdentity`. For role assumption within a partition, use the `AssumeRole` API instead.
If your workload requires cross-partition access, consult your compliance team to make sure that your implementation aligns with your regulatory or compliance obligations.

## How cross-partition identity federation works
<a name="cross-partition-how-it-works"></a>

Your workload first requests a token from Amazon STS in the source partition, then sends the token to Amazon STS in the destination partition. To validate the request, Amazon STS in the destination partition retrieves verification keys from the source account's OIDC issuer, verifies the token, and evaluates the destination role's trust policy. If the request is allowed, Amazon STS returns temporary credentials to the workload, which uses them to call services and access resources in the destination partition.

<a name="cross-partition-flow-diagram"></a>![Source STS issues a token; destination STS validates it and returns credentials the workload uses to access resources.](https://docs.amazonaws.cn/en_us/IAM/latest/UserGuide/images/outbound-cross-partition-flow.png)


The flow works as follows:

1. **Token request**: Your workload, running in an Amazon Web Services Region in the source partition (for example, `us-east-1` in the `aws` partition), calls the `sts:GetWebIdentityToken` API.

1. **Token issuance**: Amazon STS returns a short-lived, cryptographically signed JWT. The token contains claims that assert your workload's Amazon identity, including the account ID, the principal Amazon Resource Name (ARN), the source Amazon Web Services Region, and more.

1. **Token presentation**: Your workload calls `sts:AssumeRoleWithWebIdentity` on the Amazon STS endpoint in an Amazon Web Services Region in the destination partition (for example, `cn-north-1` in the `aws-cn` partition), passing the JWT as the web identity token and the ARN of the target role in the destination partition.

1. **Fetch verification keys and metadata**: Amazon STS in the destination partition retrieves the public verification key from the JWKS endpoint of the source account's issuer URL.

1. **Validation**: Amazon STS in the destination partition verifies the token's signature and evaluates the target role's trust policy.

1. **Return temporary credentials**: Amazon STS in the destination partition returns temporary credentials scoped by the policies attached to the role.

1. **Cross-partition resource access**: Your workload uses the temporary credentials to access resources in the destination partition, such as an Amazon S3 bucket.

For more information, see the following topics:
+ [Setting up cross-partition identity federation](id_roles_providers_outbound_cross_partition_setup.md)
+ [Controls for cross-partition identity federation](id_roles_providers_outbound_cross_partition_controls.md)
+ [Auditing cross-partition identity federation](id_roles_providers_outbound_cross_partition_auditing.md)
+ [Available keys for Amazon OIDC federation](reference_policies_iam-condition-keys.md#condition-keys-wif)