OIDC Federation

Connecting a cloud account via OIDC avoids long-lived static credentials. The DriftWise scan worker presents a short-lived JSON Web Token (JWT) to your cloud, which validates it against the trust configuration you set up.

Each cloud uses this slightly differently:

• AWS validates iss, sub, and aud claims against the OIDC provider / trust policy you register. Trust policies should also pin the dw_org_id claim — it carries your organization UUID.
• Azure validates iss, sub, and aud claims against the federated credential you register.
• GCP uses Workload Identity Federation plus service-account impersonation — you grant a per-organization DriftWise federation principal permission to impersonate a scanner service account that you create in your own project.

Follow the per-cloud setup guide:

• AWS OIDC Federation
• Azure OIDC Federation
• GCP Workload Identity

Production trust configuration values

DriftWise issues its own identity tokens from a stable OIDC endpoint. The tokens are scoped to your organization: the sub claim is org-<your-org-uuid> and the dw_org_id claim is your org UUID, so there is no deployment-wide subject value to copy from documentation — your exact values are rendered for you in the product (see How to retrieve them below).

Value	Production value	Used by
Issuer URL	https://federation.driftwise.ai	AWS (--url), Azure (issuer)
Subject	org-<your-org-uuid> (per-organization)	AWS (sub condition), Azure (subject)
Org claim	dw_org_id = <your-org-uuid>	AWS (extra trust-policy condition)
Audience	https://app.driftwise.ai/federation	AWS (aud condition), Azure (audiences)
GCP impersonation member	per-org WIF principal (principal://iam.googleapis.com/.../subject/org-<your-org-uuid>)	GCP (iam.serviceAccountTokenCreator member on your scanner SA)

Self-hosted or non-production deployments

The values above are for the hosted app.driftwise.ai service. If you run DriftWise in a different environment (dev, staging, or self-hosted), the Setup Instructions panel in that deployment's UI renders the environment's own issuer and per-org values. Note the AWS/Azure aud value is fixed at https://app.driftwise.ai/federation on every deployment of the current code — tokens are minted with that constant audience regardless of environment.

How to retrieve them

From the UI

1. Open Cloud Scan → + Add Account and pick your cloud.
2. Select an OIDC credential type (OIDC Federation for AWS/Azure, Workload Identity for GCP).
3. The Setup Instructions panel appears automatically, with your org-specific trust-policy template, principal names, and CLI commands ready to copy-paste.

From the API

Any org member can fetch the same copy-paste-ready values:

curl -H "x-api-key: $DRIFTWISE_API_KEY" \
  "https://api.driftwise.ai/api/v2/orgs/$ORG_ID/cloud-onboarding-info?provider=aws"

provider is required (aws, gcp, or azure). The endpoint returns 503 Service Unavailable if the deployment was booted without federation configured for that provider.

The response includes your issuer URL, audience, and per-org subject, plus provider-specific payloads: a rendered AWS trust-policy JSON and OIDC-provider create command, the Azure federated-credential parameters and az CLI command, or the GCP WIF principal + IAM grant command for your organization.