---
title: AWS CLI authentication
sidebar_label: AWS
tags: [authentik Agent, authentik cli, aws, cli]
authentik_version: "2025.12.0"
---

You can use the authentik Agent to authenticate to the AWS CLI with authentik credentials.

## Prerequisites

- The authentik Agent must be deployed on your device.

## authentik configuration

To support the integration of authentik Agent with AWS CLI, you need to create an application/provider pair in authentik.

### Create an application and provider in authentik for AWS CLI

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
    - **Application**: provide a descriptive name (e.g. `authentik-aws-cli`), an optional group for the type of application, the policy engine mode, and optional UI settings.
    - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type.
    - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations.
        - Set the **Client type** to `Public`.
        - Set the **Client ID** to `authentik-aws-cli`.
        - Select any available signing key.
        - Under **Machine-to-Machine authentication settings** add the `authentik-cli` provider as a **Federated OIDC Provider**.
    - **Configure Bindings** _(optional)_: you can create a [binding](../../../../add-secure-apps/bindings-overview/index.md) (policy, group, or user) to manage access to the application.

3. Click **Submit** to save the new application and provider.

## AWS configuration

To support the integration of AWS with the authentik Agent, you need to configure authentik CLI as an IdP and set up permission roles in AWS.

### Configure authentik CLI as an IDP in AWS

1. Log in to the AWS Management Console as an administrator that has permissions to create IAM roles and identity providers.
2. Open the [IAM Console](https://console.aws.amazon.com/iam/) and in the left sidebar under **Access Management**, click **Identity providers**.
3. Click **Add provider** and configure the following fields:
    - **Provider type**: `OpenID Connect`
    - **Provider URL**: `https://authentik.company/application/o/<application-slug>/`
    - **Audience**: `authentik-aws-cli`
4. Click **Add provider**
5. On the **Identity providers** page, click on the name of the provider that you just added.

### Configure permissions in AWS

1. Log in to the AWS Management Console as an administrator that has permissions to create IAM roles and identity providers.
2. Open the [IAM Console](https://console.aws.amazon.com/iam/) and in the left sidebar under **Access Management**, click **Roles**.
3. Either create or edit a role that you want authentik users to be able to use.
4. Open the **Trust relationships** tab.
5. Click **Edit trust policy** and add the following, replacing `<account_id>` with your AWS Account ID:

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::<account_id>:oidc-provider/authentik.company/application/o/authentik-aws-cli/"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "authentik.company/application/o/authentik-aws-cli/:aud": "authentik-aws-cli"
                }
            }
        }
    ]
}
```

6. Click **Update policy**.
7. Take note of the role ARN as it will be required in the next section.

### Configure AWS CLI to authenticate with authentik CLI

On the device running AWS CLI, update the `~/.aws/credentials` file with the following, replacing `<role_arn>` with the ARN of the role above:

```
[default]
credential_process = ak auth aws --client-id authentik-aws-cli --role-arn <role_arn>
```

To verify, run `aws sts get-caller-identity`, which should output something like this

```json
{
    "UserId": "xxxxxx",
    "Account": "<account_id>",
    "Arn": "arn:aws:sts::<account_id>:assumed-role/<role name>/<authentik username>"
}
```