Workload identity: AWS
Workloads on AWS (Lambda, ECS, EKS, EC2) run with an IAM role. When your account has IAM outbound identity federation turned on, AWS can issue a signed OIDC token for that role, which you exchange for a Syntic access token. The Syntic trust rule then accepts only the roles you name.
What you match on
| Claim | Example | Use it to |
|---|---|---|
iss | Your account’s issuer URL, as shown in IAM | Set as the rule’s issuer. |
sub | arn:aws:iam::123456789012:role/summariser | Trust one IAM role. |
aud | https://app.syntic.ai | Set as the rule’s audience. |
Set it up
Turn on outbound identity federation
In IAM, enable the feature that lets roles in your account obtain OIDC tokens, and note the issuer URL it shows for your account.
Allow the role to request tokens
Grant the workload’s role permission to request a web identity token for the audience https://app.syntic.ai, and nothing broader.
Create the Syntic service account and trust rule
{
"issuer": "https://<your account issuer from IAM>",
"audience": "https://app.syntic.ai",
"conditions": {
"sub": "arn:aws:iam::123456789012:role/summariser"
},
"max_token_lifetime_seconds": 900
}A trailing * matches a prefix, for example arn:aws:iam::123456789012:role/syntic-* for a family of roles. Prefer naming exact roles.
Fetch and exchange the token at run time
# Sketch of the flow. Get the AWS-issued token with your language's AWS SDK
# (the web identity token call for audience "https://app.syntic.ai"), then exchange it.
import requests
aws_jwt = get_aws_identity_token(audience="https://app.syntic.ai") # your AWS SDK call
syntic = requests.post(
"https://app.syntic.ai/v1/oauth/token",
headers={"syntic-beta": "token-exchange-2026-11-01"},
json={
"grant_type": "urn:ietf:params:oauth:grant-type:token-exchange",
"subject_token": aws_jwt,
"subject_token_type": "urn:ietf:params:oauth:token-type:jwt",
"service_account": "svcacct_01JCB3D5F7H9K1M3P5R7",
},
timeout=30,
).json()
headers = {"Authorization": f"Bearer {syntic['access_token']}"}For EKS, you can also use the cluster’s own service-account tokens; see Kubernetes.
If outbound identity federation is not available in your account, keep using an API key stored in AWS Secrets Manager, scoped to a dedicated workspace with a spend limit and an IP allowlist.