AWS Sign-In now supports OAuth 2.0 Token Exchange

AWS Sign-In now supports OAuth 2.0 Token Exchange (RFC 8693), enabling applications to exchange third-party OpenID Connect (OIDC) tokens for short-lived, AWS service-scoped OAuth access tokens. This allows customers to securely integrate third-party applications with supported AWS services without sharing AWS credentials, while maintaining access controls through AWS Identity and Access Management (IAM).

This capability is available for supported AWS services that use AWS Sign-In OAuth, enabling customers to use existing identity providers to securely access AWS services without managing additional credentials.

To learn more, see the AWS Sign-In User Guide, AWS MCP Server User Guide and the AWS Glue launch announcement.