IAM federated identity providers

Inventories every federated identity provider registered in the account, both OIDC and SAML, in one query. Each provider is a trusted external issuer whose identities can assume roles, so this is the counterpart to the role trust review: an unrecognised provider means unrecognised principals can obtain credentials.

Query

SELECT arn, 'oidc' as provider_type
FROM aws.iam.open_id_connect_providers
WHERE region = 'us-east-1'
UNION ALL
SELECT arn, 'saml' as provider_type
FROM aws.iam.saml_providers
WHERE region = 'us-east-1';

Notes

OIDC providers are typically CI/CD and workload federation (an ARN ending in token.actions.githubusercontent.com is GitHub Actions); SAML providers are typically workforce SSO. Which roles each provider can reach comes from the role trust policies - see aws/iam/roles-external-trust, whose trusts_oidc_federation and trusts_saml_federation flags mark the roles involved. Note that roles assumed through AWS IAM Identity Center (SSO) do not appear here: Identity Center manages its own provider and provisions roles with a path of /aws-reserved/. An empty result means no federation is configured and all access is via IAM principals. IAM is global, so region = 'us-east-1' is endpoint routing.