Workload Identity for AWS

AWS IAM outbound identity federation gives an IAM role a signed JWT through the STS GetWebIdentityToken action. Dodo Payments trusts this token through an aws provider. Use it for Lambda, ECS, EC2, and other AWS compute that has an IAM role.

For pods on Amazon EKS, use the Kubernetes type with a projected service account token.

Provider Settings

Setting	Value
Provider type	`aws`
Issuer	The account issuer, `https://<id>.tokens.sts.global.api.aws`
Audience	`https://live.dodopayments.com` or `https://test.dodopayments.com`
Replay protection	Each JWT can do one exchange (`jti`).
JWT lifetime	1 hour or less.

Turn on outbound identity federation in your AWS account, then copy the issuer URL of the account into the provider.

Required Claims

The mapping must pin sub with the ARN of the IAM role:

[
  { "claim": "sub", "value": "arn:aws:iam::111122223333:role/billing-worker" }
]

IAM Permissions

The role of the workload must have permission to call sts:GetWebIdentityToken. This policy lets the role get tokens only for the Dodo Payments audience, with a maximum lifetime of 5 minutes:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:GetWebIdentityToken",
      "Resource": "*",
      "Condition": {
        "ForAllValues:StringEquals": {
          "sts:IdentityTokenAudience": "https://live.dodopayments.com"
        },
        "NumericLessThanEquals": {
          "sts:DurationSeconds": 300
        }
      }
    }
  ]
}

For test mode, use https://test.dodopayments.com as the audience.

SDK Usage

The aws(fn) helper takes a function that returns a new JWT. Call GetWebIdentityToken in that function with the Dodo Payments audience. The SDK calls the function for each exchange. GetWebIdentityToken needs a signing algorithm: RS256 or ES384. The action is not available on the STS global endpoint, so configure the STS client with a region.

import DodoPayments from 'dodopayments';
import { STSClient, GetWebIdentityTokenCommand } from '@aws-sdk/client-sts';

const sts = new STSClient({});

const client = new DodoPayments({
  environment: 'live_mode',
  workloadIdentity: {
    identityProviderId: process.env.DODO_PAYMENTS_IDENTITY_PROVIDER_ID,
    provider: DodoPayments.workloadIdentity.aws(async () => {
      const result = await sts.send(
        new GetWebIdentityTokenCommand({
          Audience: ['https://live.dodopayments.com'],
          SigningAlgorithm: 'RS256',
          DurationSeconds: 300,
        }),
      );
      return result.WebIdentityToken!;
    }),
  },
});

import os
import boto3
from dodopayments import DodoPayments
from dodopayments.workload_identity import WorkloadIdentity, aws

sts = boto3.client("sts")

def get_jwt() -> str:
    response = sts.get_web_identity_token(
        Audience=["https://live.dodopayments.com"],
        SigningAlgorithm="RS256",
        DurationSeconds=300,
    )
    return response["WebIdentityToken"]

client = DodoPayments(
    environment="live_mode",
    workload_identity=WorkloadIdentity(
        identity_provider_id=os.environ["DODO_PAYMENTS_IDENTITY_PROVIDER_ID"],
        provider=aws(get_jwt),
    ),
)

Refer to SDK Usage for the other languages.

Getting Started

Features

Integrate

Merchant of Record

Miscellaneous

Provider Settings

Required Claims

IAM Permissions

SDK Usage

​Provider Settings

​Required Claims

​IAM Permissions

​SDK Usage

Provider Settings

Required Claims

IAM Permissions

SDK Usage