# 限制对受信任的 OIDC 身份提供商的访问

resource：<https://github.com/aws-samples/resource-control-policy-examples/blob/main/Limit-access-to-trusted-OIDC-identity-providers/Limit-access-to-trusted-OIDC-identity-providers.md>

resource: <https://github.com/aws-samples/resource-control-policy-examples/blob/main/Limit-access-to-trusted-OIDC-identity-providers/Shared-Issuers.json>

OIDC 联合身份验证可用于向已通过 OpenID Connect 兼容身份提供商 （IdP） 向 AWS 环境中的 IAM OpenID Connect （OIDC） 身份提供商进行身份验证的用户提供临时安全凭证。本节概述了控制外部 OIDC 身份提供商 （IdP） 用于授予对组织资源的访问权限的授权机制的控制示例。

Here is a list of the service providers covered in this sample, and their documentation:

| Provider                             | Documentation                                                                                                                                                                                                                                                                                                                                                      | Issuer/OIDC Provider URL                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | Policy Statement in [Shared-Issuers.json](https://github.com/aws-samples/resource-control-policy-examples/blob/main/Limit-access-to-trusted-OIDC-identity-providers/Shared-Issuers.json)                                                                            |
| ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Terraform Cloud                      | [Terraform Docs](https://developer.hashicorp.com/terraform/cloud-docs/workspaces/dynamic-provider-credentials/aws-configuration)                                                                                                                                                                                                                                   | <https://app.terraform.io>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | EnforceTrustedOIDCTenantTerraformCloud                                                                                                                                                                                                                              |
| GitLab                               | <p><a href="https://docs.gitlab.com/ee/ci/cloud_services/aws/">GitLab Docs</a><br><a href="https://docs.gitlab.com/ee/ci/secrets/id_token_authentication.html">ID Token Auth</a></p>                                                                                                                                                                               | <https://gitlab.com>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | EnforceTrustedOIDCTenantGitLabCLoud                                                                                                                                                                                                                                 |
| IBM Turbonomic SaaS                  | <p><a href="https://www.ibm.com/docs/en/tarm/8.13.0?topic=suaiuir-setting-up-aws-iam-role-turbonomic-saas-deployments">IBM Docs</a><br><a href="https://www.ibm.com/docs/en/tarm/8.14.6?topic=turbonomic-setting-up-aws-iam-role-saas-deployments">IBM Docs</a><br><a href="https://www.ibm.com/support/pages/turbonomic-saas-iam-role-setup">Support Page</a></p> | <p><a href="https://rh-oidc.s3.us-east-1.amazonaws.com/22ejnvnnturfmt6km08idd0nt4hekbn7"><https://rh-oidc.s3.us-east-1.amazonaws.com/22ejnvnnturfmt6km08idd0nt4hekbn7></a><br><a href="https://rh-oidc.s3.us-east-1.amazonaws.com/23e3sd27sju1hoou6ohfs68vbno607tr"><https://rh-oidc.s3.us-east-1.amazonaws.com/23e3sd27sju1hoou6ohfs68vbno607tr></a><br><a href="https://rh-oidc.s3.us-east-1.amazonaws.com/23ne21h005qjl3n33d8dui5dlrmv2tmg"><https://rh-oidc.s3.us-east-1.amazonaws.com/23ne21h005qjl3n33d8dui5dlrmv2tmg></a><br><a href="https://rh-oidc.s3.us-east-1.amazonaws.com/24jrf12m5dj7ljlfb4ta2frhrcoadm26"><https://rh-oidc.s3.us-east-1.amazonaws.com/24jrf12m5dj7ljlfb4ta2frhrcoadm26></a><br><a href="https://oidc.op1.openshiftapps.com/2f785sojlpb85i7402pk3qogugim5nfb"><https://oidc.op1.openshiftapps.com/2f785sojlpb85i7402pk3qogugim5nfb></a><br><a href="https://oidc.op1.openshiftapps.com/2c51blsaqa9gkjt0o9rt11mle8mmropu"><https://oidc.op1.openshiftapps.com/2c51blsaqa9gkjt0o9rt11mle8mmropu></a></p> | <p>EnforceTrustedOIDCTenantIbmTurboNomic1<br>EnforceTrustedOIDCTenantIbmTurboNomic2<br>EnforceTrustedOIDCTenantIbmTurboNomic3<br>EnforceTrustedOIDCTenantIbmTurboNomic4<br>EnforceTrustedOIDCTenantIbmTurboNomic5<br>EnforceTrustedOIDCTenantIbmTurboNomic6<br></p> |
| Shisho.dev                           | [Shisho Docs](https://shisho.dev/docs/g/getting-started/integrate-apps/aws/)                                                                                                                                                                                                                                                                                       | <https://tokens.cloud.shisho.dev>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | EnforceTrustedOIDCTenantShishoDev                                                                                                                                                                                                                                   |
| Scalr                                | [Scalr Docs](https://docs.scalr.io/docs/aws)                                                                                                                                                                                                                                                                                                                       | <https://scalr.io>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | EnforceTrustedOIDCTenantScalr                                                                                                                                                                                                                                       |
| GitHub Audit Log Streaming           | [GitHub Docs](https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-amazon-s3)                                                                                                                              | <https://oidc-configuration.audit-log.githubusercontent.com>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | EnforceTrustedOIDCTenantGithubLogStreaming                                                                                                                                                                                                                          |
| Pulumi                               | [Pulumi Docs](https://www.pulumi.com/docs/pulumi-cloud/oidc/provider/aws/)                                                                                                                                                                                                                                                                                         | <https://api.pulumi.com>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | EnforceTrustedOIDCTenantPulumi                                                                                                                                                                                                                                      |
| Buildkite                            | [Buildkite Docs](https://buildkite.com/docs/agent/v3/cli-oidc)                                                                                                                                                                                                                                                                                                     | <https://agent.buildkite.com>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | EnforceTrustedOIDCTenantBuildKite                                                                                                                                                                                                                                   |
| Upbound                              | [Upbound Docs](https://docs.upbound.io/all-spaces/legacy-spaces/multicloud-deploy/)                                                                                                                                                                                                                                                                                | <https://proidc.upbound.io>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | EnforceTrustedOIDCTenantUpbound                                                                                                                                                                                                                                     |
| GitHub Actions - Self Hosted Runners | [GitHub Actions Docs](https://github.com/actions/runner/blob/main/docs/checks/actions.md)                                                                                                                                                                                                                                                                          | <https://vstoken.actions.githubusercontent.com>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | EnforceTrustedOIDCTenantGithubActionsSelfHosted                                                                                                                                                                                                                     |
| Vercel                               | [Vercel Docs](https://vercel.com/docs/security/secure-backend-access/oidc/reference)                                                                                                                                                                                                                                                                               | <https://oidc.vercel.com>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | EnforceTrustedOIDCTenantVercel                                                                                                                                                                                                                                      |
| Sandboxes.cloud                      | [Sandboxes Docs](https://docs.sandboxes.cloud/docs/cloud-resources-setup)                                                                                                                                                                                                                                                                                          | <https://sandboxes.cloud>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | EnforceTrustedOIDCTenantSandBoxes                                                                                                                                                                                                                                   |
| Datachain.ai                         | [Datachain Docs](https://dvc.org/doc/studio/user-guide/openid-connect)                                                                                                                                                                                                                                                                                             | <https://studio.datachain.ai/api>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | EnforceTrustedOIDCTenantDataChain                                                                                                                                                                                                                                   |
| Codefresh                            | [Codefresh Docs](https://codefresh.io/docs/docs/integrations/oidc-pipelines/)                                                                                                                                                                                                                                                                                      | <https://oidc.codefresh.io>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | EnforceTrustedOIDCTenantCodeFresh                                                                                                                                                                                                                                   |

This list may not include all possible third party service providers that use a shared issuer URL with their OIDC integration to access AWS accounts. Please review all relevant documentation from your service providers to ensure your security objectives are met when configuring an OIDC integration to AWS from your third party service providers.
