View a markdown version of this page

Amazon prerequisites - Amazon Systems Manager
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Amazon prerequisites

Complete the following steps in your Amazon Web Services account.

To set up the Amazon side of the federation
  1. Enable outbound web identity federation

    Enable outbound web identity federation in your Amazon Web Services account IAM settings. This allows Amazon to issue OIDC tokens that Azure can verify.

    In the IAM console, navigate to Account settings and enable Outbound web identity federation. Alternatively, use the Amazon CLI:

    aws iam enable-outbound-web-identity-federation
  2. Note the OIDC issuer URL

    After enabling outbound web identity federation, note the Amazon OIDC issuer URL for your account. The URL has the following format:

    https://UNIQUE_ID.tokens.sts.global.api.aws

    You need this URL when configuring the federated identity credential in Azure.