OpenID Connect (OIDC) CloudTrail Query Runbooks cut through that noise. They give you a precise set of steps to detect, investigate, and respond to suspicious OIDC activity inside AWS. Instead of chasing raw log streams, you run a targeted query, confirm what happened, and take action before it becomes a headline.
AWS CloudTrail records every call to the AssumeRoleWithWebIdentity API, token exchange, and identity provider configuration change. For OIDC, these events are critical. A malicious client ID, a sudden switch in identity provider URLs, or unexpected role assumptions all leave traces here. A well-crafted runbook turns that forensic data into operational defense.
An effective OIDC CloudTrail runbook starts with event filtering. Use eventSource = "sts.amazonaws.com" with eventName IN ("AssumeRoleWithWebIdentity") to isolate OIDC role assumptions. Tag queries to look for source IPs outside approved CIDR blocks, mismatched audience claims, or roles not assigned to the calling identity provider.
Next, flag identity provider modifications. Query for eventSource = "iam.amazonaws.com" and eventName IN ("CreateOpenIDConnectProvider", "UpdateOpenIDConnectProviderThumbprint", "DeleteOpenIDConnectProvider"). These indicate changes to trust boundaries. Correlate each change with who made it, from where, and at what time.