Skip to main content

Secure Service Consumption on AWS

Last updated on by alperdedeoglu

This section outlines the architecture for securely accessing AWS services from external environments, such as applications running on SAP Business Technology Platform (SAP BTP).

The first approach utilizes OIDC Federation via SAP Identity Authentication Service (IAS). In this model, applications retrieve identity tokens from IAS and use them to assume IAM roles via AWS Security Token Service (STS). This token-based method avoids the need for managing certificates or static credentials, making it ideal for applications already integrated with IAS.

Alternatively, AWS IAM Roles Anywhere allows certificate-based access to AWS services. Trusted workloads can assume IAM roles using X.509 certificates from a trusted certificate authority, eliminating the need for hardcoded credentials or persistent access keys, and ensuring short-lived, auditable access.

Both identity federation and certificate-based access ensure secure, scalable service consumption, serving as a reference pattern for implementing zero-trust principles in hybrid environments.

Architecture​

image of solution diagram
Copy to clipboard

Solution Diagram Resources
You can download the Solution Diagram as a .drawio file for offline use. Alternatively, you may view and edit the Solution Diagram directly on draw.io.
Please note that any changes made online will need to be saved locally if you wish to keep them.
DownloadEdit

Flow​

This alternative pattern demonstrates how to access AWS services by treating the application created within SAP IAS as an OIDC Identity Provider (IdP) for AWS.

Prerequisites:​

  1. Register SAP IAS as an OIDC Provider in AWS
    Add your IAS application metadata to AWS IAM as a new Identity Provider using OIDC IdP setup.
  2. Create IAM Role with Trust Policy

Runtime Flow:​

  1. Application obtains ID token from SAP IAS.
  2. Application uses this token to assume an IAM Role using STS.
  3. AWS issues temporary credentials scoped by the role's permissions.
  4. Application accesses AWS services with these credentials.

Characteristics​

CharacteristicDescription
Authentication TypeOpenID Connect JWT Token
Credential HandlingNo certificate management required
Best Fit ForUser-centric applications, UIs, or apps already using SAP IAS
Federation SupportCan federate with corporate IdPs via IAS
Token Lifetime / Credential RotationToken-based (short-lived, configurable)
ComplexityVery low implementation complexity
Security PostureToken validation + audience matching
SAP BTP CompatibilityIdeal for workloads having a SAP IAS application

Services and Components​

This integration leverages SAP Identity Authentication Service (IAS) as an OpenID Connect (OIDC) Identity Provider (IdP) to securely obtain temporary AWS credentials through AWS Security Token Service (STS). Below are the core components involved in this architecture:

ComponentRole
SAP IASActs as the trusted OIDC Identity Provider that issues signed ID tokens on behalf of the application.
AWS IAMA representation of IAS within AWS, registered using its metadata to allow token-based identity federation.
AWS IAM RoleA role that trusts the IAS OIDC provider and defines permissions for the application to access AWS services.
AWS STSExchanges the IAS-issued token for temporary AWS credentials.
Tip

This flow simplifies access control and identity federation, making it particularly suitable for SAP BTP applications — even those using XSUAA — where leveraging an existing IAS trust allows secure AWS access without managing certificates.

Resources​