Federated authentication to AWS

This article describes how you can let an ADK agent use AssumeRoleWithWebIdentity to assume an AWS role and call AWS APIs and MCP tools that use SigV4 authentication .

Follow the steps in this article if all of the following applies:

Your agent is deployed on Agent Platform or Cloud Run
Your agent is configured to use agent identity or has an attached service account
You want the agent to access an API or MCP tool that requires AWS SigV4 authentication

Approach

ADK agents running on Agent Platform or Cloud Run can obtain an ID token that asserts their agent identity or the identity of their attached service account.

If you create an AWS role with an appropriate trust policy, you can let an agent use this ID token to assume the role and obtain temporary AWS credentials. The agent can then use these temporary AWS credentials to call AWS APIs, use the AWS MCP Server or custom MCP servers that require SigV4 authentication.

AwsFederatedAuthProvider is an ADK authentication provider that implements the necessary logic to obtain an ID token and exchange it for temporary AWS credentials.
AwsMcpToolset extends the ADK-provided McpToolset class and lets you use MCP servers that require SigV4 authentication, such as the AWS MCP Server .

Using AwsFederatedAuthProvider lets you avoid the need to store AWS secrets on Google Cloud.

Create an AWS IAM role

In AWS, create an IAM role for OIDC and configure a trust policy. The content of the trust policy depends on whether your agent uses agent identity or an attached service account:

Service accountAgent identity

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "accounts.google.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "accounts.google.com:oaud": "https://sts.amazonaws.com",
          "accounts.google.com:sub": "ID"
        }
      }
    }
  ]
}

Replace ID with the ID of the service account. The ID looks similar to the following: 102770123456789012345.

The tokens issued by Agent identity are not signed by the Google JWKS and can't be validated using AWS built-in support for Google federation. Therefore, you must create an OIDC identity provider for agent identity:

Provider type: OpenID Connect

Provider URL:

https://sts.googleapis.com/v1/organizations/ORG_ID/locations/global/workloadIdentityPools/agents.global.org-ORG_ID.system.id.goog

Replace ORG_ID with the organization ID of the Google Cloud organization that contains the agent.

Audience: https://sts.amazonaws.com

Use the identity provider to configure the trust policy as follows:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "OIDC_PROVIDER_ARN"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "sts.googleapis.com/v1/organizations/ORG_ID/locations/global/workloadIdentityPools/agents.global.org-ORG_ID.system.id.goog:sub": "spiffe://agents.global.org-ORG_ID.system.id.goog/resources/aiplatform/RESOURCE_NAME"
        }
      }
    }
  ]
}

Replace the following:

OIDC_PROVIDER_ARN: the ARN of the OIDC identity provider that you created in the previous step
ORG_ID: the organization ID of the Google Cloud organization that contains the agent
RESOURCE_NAME: the resource name of the Agent Runtime deployment as shown in the Cloud Console under Agent Platform > Agents > Deployments.

The resource name looks similar to projects/1234567890/locations/asia-southeast1/reasoningEngines/5678901234567890.

Use the authentication provider

To let your ADK agent use AWS federation, do the following:

Add the following code to your agent to initialize a AwsSigV4Scheme and register the provider:

from aws_auth import AwsSigV4Scheme, AwsFederatedAuthProvider

aws_auth_scheme = AwsSigV4Scheme(
    role_arn="arn:aws:iam::ACCOUNT_ID:role/ROLE",
    role_session_name="SESSION_NAME",
)

CredentialManager.register_auth_provider(AwsFederatedAuthProvider(
    region_name="STS_REGION"
))

Replace the following:

ACCOUNT_ID: the AWS account ID.
ROLE: the name of the AWS role to assume.
SESSION_NAME: a name of your choice for the AWS session.
STS_REGION: the AWS region to use for STS, for example eu-central-1.

Initialize an instance of AwsMcpToolset (as a replacement for McpToolset) and pass the AwsSigV4Scheme instance.

For example, initialize a toolset for the AWS MCP server as follows:

from aws_auth import AwsMcpToolset

aws_toolset = AwsMcpToolset(
    "eu-central-1",
    "bedrock-agentcore",
    "https://aws-mcp.eu-central-1.api.aws/mcp",
    aws_auth_scheme
)

Include the following environment variable in your deployment to disable mTLS:
```
GOOGLE_API_USE_CLIENT_CERTIFICATE=False
```
If you use adk deploy to deploy the agent, add the environment variable to your .agent_engine_config.json.

Important

If you leave mTLS enabled, the ADK ignores the authentication scheme passed in the constructor and uses application default credentials instead .