> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dodopayments.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Workload Identity for AWS

> Call the Dodo Payments API from AWS workloads with a JWT from AWS IAM outbound identity federation, signed for the IAM role of the workload.

AWS IAM outbound identity federation gives an IAM role a signed JWT through the STS `GetWebIdentityToken` action. Dodo Payments trusts this token through an `aws` provider. Use it for Lambda, ECS, EC2, and other AWS compute that has an IAM role.

> [!NOTE]
>
> For pods on Amazon EKS, use the [Kubernetes](https://docs.dodopayments.com/developer-resources/workload-identity/providers/kubernetes.md) type with a projected service account token.

## Provider Settings

| Setting | Value |
| - | - |
| Provider type | `aws` |
| Issuer | The account issuer, `https://<id>.tokens.sts.global.api.aws` |
| Audience | `https://live.dodopayments.com` or `https://test.dodopayments.com` |
| Replay protection | Each JWT can do one exchange (`jti`). |
| JWT lifetime | 1 hour or less. |

Turn on outbound identity federation in your AWS account, then copy the issuer URL of the account into the provider.

## Required Claims

The mapping must pin `sub` with the ARN of the IAM role:

```json theme={null}
[
  { "claim": "sub", "value": "arn:aws:iam::111122223333:role/billing-worker" }
]
```

## IAM Permissions

The role of the workload must have permission to call `sts:GetWebIdentityToken`. This policy lets the role get tokens only for the Dodo Payments audience, with a maximum lifetime of 5 minutes:

```json theme={null}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:GetWebIdentityToken",
      "Resource": "*",
      "Condition": {
        "ForAllValues:StringEquals": {
          "sts:IdentityTokenAudience": "https://live.dodopayments.com"
        },
        "NumericLessThanEquals": {
          "sts:DurationSeconds": 300
        }
      }
    }
  ]
}
```

For test mode, use `https://test.dodopayments.com` as the audience.

## SDK Usage

The `aws(fn)` helper takes a function that returns a new JWT. Call `GetWebIdentityToken` in that function with the Dodo Payments audience. The SDK calls the function for each exchange.

`GetWebIdentityToken` needs a signing algorithm: `RS256` or `ES384`. The action is not available on the STS global endpoint, so configure the STS client with a region.

```typescript TypeScript theme={null}
import DodoPayments from 'dodopayments';
import { STSClient, GetWebIdentityTokenCommand } from '@aws-sdk/client-sts';

const sts = new STSClient({});

const client = new DodoPayments({
  environment: 'live_mode',
  workloadIdentity: {
    identityProviderId: process.env.DODO_PAYMENTS_IDENTITY_PROVIDER_ID,
    provider: DodoPayments.workloadIdentity.aws(async () => {
      const result = await sts.send(
        new GetWebIdentityTokenCommand({
          Audience: ['https://live.dodopayments.com'],
          SigningAlgorithm: 'RS256',
          DurationSeconds: 300,
        }),
      );
      return result.WebIdentityToken!;
    }),
  },
});
```

```python Python theme={null}
import os
import boto3
from dodopayments import DodoPayments
from dodopayments.workload_identity import WorkloadIdentity, aws

sts = boto3.client("sts")

def get_jwt() -> str:
    response = sts.get_web_identity_token(
        Audience=["https://live.dodopayments.com"],
        SigningAlgorithm="RS256",
        DurationSeconds=300,
    )
    return response["WebIdentityToken"]

client = DodoPayments(
    environment="live_mode",
    workload_identity=WorkloadIdentity(
        identity_provider_id=os.environ["DODO_PAYMENTS_IDENTITY_PROVIDER_ID"],
        provider=aws(get_jwt),
    ),
)
```

Refer to [SDK Usage](https://docs.dodopayments.com/developer-resources/workload-identity/sdk-usage.md) for the other languages.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.