A production system needed AWS resources. The identity flow had to run through Keycloak. Nothing could leak, nothing could fail, and it had to be live before morning.
AWS access with Keycloak integration is not a luxury. It’s the backbone when you need secure, standards-compliant authentication across cloud resources without scattering static credentials. The right setup ensures that developers never copy sensitive keys into code or config files. Instead, sessions and roles flow from Keycloak to AWS on demand.
The cleanest approach uses AWS Security Token Service (STS) with OpenID Connect (OIDC) federation. Keycloak acts as the OpenID Provider. AWS becomes the relying party. Users authenticate to Keycloak, which signs an ID token. That token is trusted by AWS through an identity provider you configure in the AWS IAM console. The result is short-lived credentials for specific IAM roles, provisioned securely, without storing AWS access keys in persistent storage.
To implement this:
- Create an Identity Provider in AWS IAM with the Keycloak OIDC metadata URL.
- Map the Keycloak client audience to your AWS provider settings.
- Define IAM roles with trust policies for the Keycloak provider.
- Use the AWS CLI or SDK to assume roles after obtaining Keycloak ID tokens.
With this in place, your authentication flow becomes streamlined. Local dev, CI pipelines, and cloud apps can request AWS resources through Keycloak without exposing long-term credentials. You enforce least privilege at the role level, monitor every request in CloudTrail, and rotate trust automatically with every login.
Security improves because tokens expire fast. Compliance becomes easier because identity is centralized. Developer productivity increases because there’s no manual credential shuffling. When something breaks, there’s only one place to look — Keycloak.
The difference is measurable: fewer credential leaks, faster onboarding for new engineers, and cleaner separation between identity control and cloud policy.
If you want to skip hours of manual configuration and see AWS-access-through-Keycloak in action, you can have it running live in minutes with hoop.dev — short-lived, scoped access to AWS through Keycloak without the headaches.