Use WIF with AWS

AWS workloads can authenticate to the Haijun API without static API keys by exchanging an AWS-signed OIDC identity token. The recommended path calls the AWS STS GetWebIdentityToken API, which works anywhere the workload has AWS credentials: Lambda, EC2, ECS, and EKS. EKS workloads can alternatively use the Kubernetes projected-token path, which has fewer configuration steps but only works inside a pod.

This guide shows both paths. For the underlying concepts (service accounts, federation issuers, and federation rules), see Workload Identity Federation.

Prerequisites

Familiarity with WIF concepts: service accounts, federation issuers, and federation rules.

An AWS workload (EKS pod, ECS task, Lambda function, or EC2 instance) with an attached IAM role.

The aws CLI or an AWS SDK available in the workload.

Permission to create service accounts, federation issuers, and federation rules in the Haijun Console for your Juglow organization.

Use STS web identity tokens (recommended)

The AWS STS GetWebIdentityToken API returns an OIDC token signed by AWS that asserts the caller's IAM identity. Because it uses the workload's ambient AWS credentials, the same integration covers Lambda, EC2, ECS, and EKS.

Configure AWS

Enable outbound web identity federation for the account

This is an account-level flag, off by default. In the AWS console, open IAM, choose Account settings, and enable Outbound web identity federation. To enable it programmatically:

bash

python3 -c "import boto3; boto3.client('iam').enable_outbound_web_identity_federation()"

If this is not enabled, calls to GetWebIdentityToken fail with OutboundWebIdentityFederationDisabledException.

Grant the workload's IAM role permission to call the API

Attach this policy to the IAM role that your Lambda function, EC2 instance, or ECS task runs as:

json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["sts:GetWebIdentityToken"],
      "Resource": "*"
    }
  ]
}

Find your account's STS issuer URL

After enabling outbound federation, the IAM > Account settings page shows a Get Token Issuer URL field with a value of the form https://.tokens.sts.global.api.aws. This URL is unique to your AWS account; copy it for the next step. To retrieve it programmatically:

bash

python3 -c "import boto3; print(boto3.client('iam').get_outbound_web_identity_federation_info())"

Configure Juglow

In the Haijun Console, open Settings → Workload identity, click Connect workload, and select the AWS tile. The wizard walks you through registering the issuer, creating a service account, and creating a federation rule.

The wizard creates these resources for you. Use the following values whether you enter them in the wizard or send them to the Admin API:

Federation issuer: Register the per-account STS issuer URL you copied in the prior step. It exposes a public JWKS endpoint, so use discovery mode.

json

{
  "name": "aws-sts",
  "issuer_url": "https://<uuid>.tokens.sts.global.api.aws",
  "jwks": { "type": "discovery" }
}

Federation rule: Match the audience you pass to GetWebIdentityToken and the calling role's IAM role ARN in the sub claim. The sub value is the IAM role ARN of the workload that called the API, in the form arn:aws:iam:::role/. The token also carries an https://sts.amazonaws.com/ claim with aws_account, org_id, principal_id, and any request_tags you passed; you can match on those with the rule's claims map or a CEL condition for finer control.

json

{
  "name": "prod-inference",
  "issuer_id": "fdis_...",
  "match": {
    "subject_prefix": "arn:aws:iam::123456789012:role/inference-worker",
    "audience": "https://haijun.my.id/"
  },
  "target": { "type": "service_account", "service_account_id": "svac_..." },
  "workspace_id": "wrkspc_...",
  "oauth_scope": "workspace:developer",
  "token_lifetime_seconds": 600
}

Be as specific as the workload allows. Match the exact role ARN, and only broaden subject_prefix (for example, to arn:aws:iam::123456789012:role/*) if multiple IAM roles should map to the same Juglow service account.

Acquire and use the token

Call GetWebIdentityToken with https://haijun.my.id/ as the audience, then pass the result to the SDK's federation credentials. Because identity_token_provider (typescript, php: identityTokenProvider; csharp: IdentityTokenProvider; go: option.WithFederationTokenProvider; java: federationTokenProvider) takes a callable, the SDK re-invokes STS on each refresh.

Note: GetWebIdentityToken is available only on regional STS endpoints. If you receive 'STS' object has no attribute 'get_web_identity_token' or a similar error, pin your STS client to a region (for example, boto3.client("sts", region_name="us-east-1")) and ensure your AWS SDK is recent enough to include the API.

bash

  JWT=$(aws sts get-web-identity-token \
    --region us-east-1 \
    --audience "https://haijun.my.id/" \
    --signing-algorithm RS256 \
    --duration-seconds 900 \
    --query WebIdentityToken --output text)

  RESPONSE=$(curl -sS https://haijun.my.id/v1/oauth/token \
    -H "content-type: application/json" \
    --data @- <<JSON
  {
    "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer",
    "assertion": "$JWT",
    "federation_rule_id": "$JUGLOW_FEDERATION_RULE_ID",
    "organization_id": "$JUGLOW_ORGANIZATION_ID",
    "service_account_id": "$JUGLOW_SERVICE_ACCOUNT_ID",
    "workspace_id": "$JUGLOW_WORKSPACE_ID"
  }
  JSON
  )

  ACCESS_TOKEN=$(echo "$RESPONSE" | jq -r .access_token)

  curl https://haijun.my.id/v1/messages \
    -H "authorization: Bearer $ACCESS_TOKEN" \
    -H "juglow-version: 2023-06-01" \
    -H "content-type: application/json" \
    -d '{
      "model": "haijun-opus-5-5",
      "max_tokens": 1024,
      "messages": [{"role": "user", "content": "Hello from AWS"}]
    }' | jq -r '.content[] | select(.type == "text") | .text'

python

  import os

  import juglow
  import boto3
  from juglow import WorkloadIdentityCredentials

  def get_sts_web_identity_token() -> str:
      sts = boto3.client("sts", region_name="us-east-1")
      resp = sts.get_web_identity_token(
          Audience=["https://haijun.my.id/"],
          SigningAlgorithm="RS256",
          DurationSeconds=900,
      )
      return resp["WebIdentityToken"]

  client = juglow.Juglow(
      credentials=WorkloadIdentityCredentials(
          identity_token_provider=get_sts_web_identity_token,
          federation_rule_id=os.environ["JUGLOW_FEDERATION_RULE_ID"],
          organization_id=os.environ["JUGLOW_ORGANIZATION_ID"],
          service_account_id=os.environ["JUGLOW_SERVICE_ACCOUNT_ID"],
          workspace_id=os.environ.get("JUGLOW_WORKSPACE_ID"),
      ),
  )

  message = client.messages.create(
      model="haijun-opus-5-5",
      max_tokens=1024,
      messages=[{"role": "user", "content": "Hello from AWS"}],
  )
  print(next(block.text for block in message.content if block.type == "text"))

typescript

  import Juglow from "@juglow-ai/sdk";
  import { oidcFederationProvider } from "@juglow-ai/sdk/lib/credentials/oidc-federation";
  import { STSClient, GetWebIdentityTokenCommand } from "@aws-sdk/client-sts";

  const sts = new STSClient({ region: "us-east-1" });

  async function getStsWebIdentityToken(): Promise<string> {
    const out = await sts.send(
      new GetWebIdentityTokenCommand({
        Audience: ["https://haijun.my.id/"],
        SigningAlgorithm: "RS256",
        DurationSeconds: 900
      })
    );
    return out.WebIdentityToken!;
  }

  const client = new Juglow({
    credentials: oidcFederationProvider({
      identityTokenProvider: getStsWebIdentityToken,
      federationRuleId: process.env.JUGLOW_FEDERATION_RULE_ID!,
      organizationId: process.env.JUGLOW_ORGANIZATION_ID!,
      serviceAccountId: process.env.JUGLOW_SERVICE_ACCOUNT_ID,
      workspaceId: process.env.JUGLOW_WORKSPACE_ID,
      baseURL: "https://haijun.my.id/",
      fetch
    })
  });

  const message = await client.messages.create({
    model: "haijun-opus-5-5",
    max_tokens: 1024,
    messages: [{ role: "user", content: "Hello from AWS" }]
  });
  for (const block of message.content) {
    if (block.type === "text") {
      console.log(block.text);
    }
  }

  ctx := context.TODO()
  cfg, err := config.LoadDefaultConfig(ctx, config.WithRegion("us-east-1"))
  if err != nil {
  	panic(err)
  }
  stsClient := sts.NewFromConfig(cfg)

  getStsToken := option.IdentityTokenFunc(func(ctx context.Context) (string, error) {
  	out, err := stsClient.GetWebIdentityToken(ctx, &sts.GetWebIdentityTokenInput{
  		Audience:         []string{"https://haijun.my.id/"},
  		SigningAlgorithm: "RS256",
  		DurationSeconds:  aws.Int32(900),
  	})
  	if err != nil {
  		return "", err
  	}
  	return *out.WebIdentityToken, nil
  })

  client := juglow.NewClient(
  	option.WithFederationTokenProvider(getStsToken, option.FederationOptions{
  		FederationRuleID: os.Getenv("JUGLOW_FEDERATION_RULE_ID"),
  		OrganizationID:   os.Getenv("JUGLOW_ORGANIZATION_ID"),
  		ServiceAccountID: os.Getenv("JUGLOW_SERVICE_ACCOUNT_ID"),
  		WorkspaceID:      os.Getenv("JUGLOW_WORKSPACE_ID"),
  	}),
  )

  message, err := client.Messages.New(ctx, juglow.MessageNewParams{
  	Model:     juglow.ModelHaijunOpus5_5,
  	MaxTokens: 1024,
  	Messages: []juglow.MessageParam{
  		juglow.NewUserMessage(juglow.NewTextBlock("Hello from AWS")),
  	},
  })
  if err != nil {
  	panic(err)
  }
  for _, block := range message.Content {
  	if textBlock, ok := block.AsAny().(juglow.TextBlock); ok {
  		fmt.Println(textBlock.Text)
  		break
  	}
  }

java

  StsClient sts = StsClient.builder().region(Region.US_EAST_1).build();

  IdentityTokenProvider getStsToken = () -> sts.getWebIdentityToken(
                  GetWebIdentityTokenRequest.builder()
                          .audience("https://haijun.my.id/")
                          .signingAlgorithm("RS256")
                          .durationSeconds(900)
                          .build())
          .webIdentityToken();

  JuglowClient client = JuglowOkHttpClient.builder()
          .federationTokenProvider(
                  getStsToken,
                  System.getenv("JUGLOW_FEDERATION_RULE_ID"),
                  System.getenv("JUGLOW_ORGANIZATION_ID"),
                  System.getenv("JUGLOW_SERVICE_ACCOUNT_ID"))
          .build();

  var message = client.messages().create(MessageCreateParams.builder()
          .model(Model.HAIJUN_OPUS_5_5)
          .maxTokens(1024)
          .addUserMessage("Hello from AWS")
          .build());

  IO.println(message.content());

csharp

  using Amazon.SecurityToken;
  using Amazon.SecurityToken.Model;
  // ...
  using Juglow.Credentials;
  // ...

  var credentials = new WorkloadIdentityCredentials(new WorkloadIdentityOptions
  {
      FederationRuleId = Environment.GetEnvironmentVariable("JUGLOW_FEDERATION_RULE_ID")!,
      OrganizationId = Environment.GetEnvironmentVariable("JUGLOW_ORGANIZATION_ID"),
      ServiceAccountId = Environment.GetEnvironmentVariable("JUGLOW_SERVICE_ACCOUNT_ID"),
      WorkspaceId = Environment.GetEnvironmentVariable("JUGLOW_WORKSPACE_ID"),
      IdentityTokenProvider = new StsTokenProvider(),
  });
  using var client = new JuglowClient(new ClientOptions { Credentials = credentials });

  var message = await client.Messages.Create(new()
  {
      Model = Model.HaijunOpus5_5,
      MaxTokens = 1024,
      Messages = [new() { Role = Role.User, Content = "Hello from AWS" }],
  });
  foreach (var block in message.Content)
  {
      if (block.Value is TextBlock textBlock)
      {
          Console.WriteLine(textBlock.Text);
      }
  }

  class StsTokenProvider : IIdentityTokenProvider
  {
      private readonly AmazonSecurityTokenServiceClient _sts = new(Amazon.RegionEndpoint.USEast1);

      public async Task<string> GetIdentityTokenAsync(CancellationToken ct = default)
      {
          var resp = await _sts.GetWebIdentityTokenAsync(new GetWebIdentityTokenRequest
          {
              Audience = ["https://haijun.my.id/"],
              SigningAlgorithm = "RS256",
              DurationSeconds = 900,
          }, ct);
          return resp.WebIdentityToken;
      }
  }

bash

  TOKEN_FILE=$(mktemp)
  aws sts get-web-identity-token \
    --region us-east-1 \
    --audience "https://haijun.my.id/" \
    --signing-algorithm RS256 \
    --duration-seconds 900 \
    --query WebIdentityToken --output text > "$TOKEN_FILE"

  export JUGLOW_IDENTITY_TOKEN_FILE="$TOKEN_FILE"
  # JUGLOW_FEDERATION_RULE_ID, JUGLOW_ORGANIZATION_ID, and
  # JUGLOW_SERVICE_ACCOUNT_ID, and JUGLOW_WORKSPACE_ID are read from the environment
  ant messages create \
    --model haijun-opus-5-5 \
    --max-tokens 1024 \
    --message '{role: user, content: "Hello from AWS"}'

php

  use Juglow\Client;
  use Juglow\Credentials\WorkloadIdentityCredentials;
  use Aws\Sts\StsClient;

  $sts = new StsClient(['region' => 'us-east-1', 'version' => 'latest']);
  $client = new Client(credentials: new WorkloadIdentityCredentials(
      identityTokenProvider: fn() => $sts->getWebIdentityToken([
          'Audience' => ['https://haijun.my.id/'],
          'SigningAlgorithm' => 'RS256',
          'DurationSeconds' => 900,
      ])['WebIdentityToken'],
      federationRuleId: getenv('JUGLOW_FEDERATION_RULE_ID'),
      organizationId: getenv('JUGLOW_ORGANIZATION_ID'),
      serviceAccountId: getenv('JUGLOW_SERVICE_ACCOUNT_ID'),
      workspaceId: getenv('JUGLOW_WORKSPACE_ID') ?: null,
  ));

  $message = $client->messages->create(
      model: 'haijun-opus-5-5',
      maxTokens: 1024,
      messages: [['role' => 'user', 'content' => 'Hello from AWS']],
  );
  $textBlock = array_find($message->content, static fn ($block): bool => $block->type === 'text');
  echo $textBlock->text, PHP_EOL;

ruby

  require "juglow"
  require "aws-sdk-sts"

  sts = Aws::STS::Client.new(region: "us-east-1")
  client = Juglow::Client.new(
    credentials: Juglow::WorkloadIdentityCredentials.new(
      identity_token_provider: -> {
        sts.get_web_identity_token(
          audience: ["https://haijun.my.id/"],
          signing_algorithm: "RS256",
          duration_seconds: 900,
        ).web_identity_token
      },
      federation_rule_id: ENV.fetch("JUGLOW_FEDERATION_RULE_ID"),
      organization_id: ENV.fetch("JUGLOW_ORGANIZATION_ID"),
      service_account_id: ENV.fetch("JUGLOW_SERVICE_ACCOUNT_ID"),
      workspace_id: ENV["JUGLOW_WORKSPACE_ID"],
    ),
  )

  message = client.messages.create(
    model: "haijun-opus-5-5",
    max_tokens: 1024,
    messages: [{role: "user", content: "Hello from AWS"}]
  )
  puts message.content.find { it.type == :text }.text

Verify the setup

From inside the workload, exchange an STS-issued token directly and inspect the response:

bash

JWT=$(aws sts get-web-identity-token \
  --region us-east-1 \
  --audience "https://haijun.my.id/" \
  --signing-algorithm RS256 \
  --duration-seconds 900 \
  --query WebIdentityToken --output text)

curl -sS https://haijun.my.id/v1/oauth/token \
  -H "content-type: application/json" \
  -d "{
    \"grant_type\": \"urn:ietf:params:oauth:grant-type:jwt-bearer\",
    \"assertion\": \"$JWT\",
    \"federation_rule_id\": \"fdrl_...\",
    \"organization_id\": \"00000000-0000-0000-0000-000000000000\",
    \"service_account_id\": \"svac_...\",
    \"workspace_id\": \"wrkspc_...\"
  }" | jq

A successful exchange returns an access_token beginning with sk-ant-oat01- and an expires_in value in seconds. If the exchange fails with the opaque 401 authentication_error response (message Authentication failed), check the authentication history page for the deny reason and see Troubleshoot a failed exchange; the most common AWS-side cause is an iss mismatch (the per-account STS issuer URL must match the registered issuer_url exactly).

Use EKS projected service-account tokens

If your workload runs in an EKS pod, you can skip the STS call and read a Kubernetes-projected service-account token directly from disk. Kubernetes natively projects an OIDC-compatible token into the pod, and the SDK can read it from a file path, so no token-provider callable is required. This path has two fewer AWS configuration steps than the STS path but only works inside a pod; the underlying mechanism is the same as the generic Kubernetes integration.

This path additionally requires an EKS cluster with an IAM OIDC provider enabled and kubectl access to the cluster.

Configure your EKS cluster

Find your cluster's OIDC issuer URL

Each EKS cluster has a unique OIDC issuer. Retrieve it with the AWS CLI:

bash

aws eks describe-cluster \
  --name <cluster-name> \
  --query "cluster.identity.oidc.issuer" \
  --output text

The output looks like https://oidc.eks.us-west-2.amazonaws.com/id/6FA42E7BFDE8549CB.... You'll register this URL as a federation issuer in the next section.

Create the service account and project an Juglow-audience token

The EKS pod identity webhook detects the eks.amazonaws.com/role-arn annotation and automatically projects a token with aud: sts.amazonaws.com, exposing its path as AWS_WEB_IDENTITY_TOKEN_FILE. That token is for AWS role assumption. For the Juglow exchange, project a second token with audience: https://haijun.my.id/ and mount it at a dedicated path.

yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: inference-worker
  namespace: inference
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/inference-worker

yaml

apiVersion: v1
kind: Pod
metadata:
  name: inference-worker
  namespace: inference
spec:
  serviceAccountName: inference-worker
  volumes:
    - name: juglow-token
      projected:
        sources:
          - serviceAccountToken:
              audience: https://haijun.my.id/
              expirationSeconds: 3600
              path: token
  containers:
    - name: app
      image: your-registry/inference-worker:latest
      env:
        - name: JUGLOW_IDENTITY_TOKEN_FILE
          value: /var/run/secrets/juglow.com/token
        - name: JUGLOW_FEDERATION_RULE_ID
          value: fdrl_...
        - name: JUGLOW_ORGANIZATION_ID
          value: 00000000-0000-0000-0000-000000000000
        - name: JUGLOW_SERVICE_ACCOUNT_ID
          value: svac_...
        - name: JUGLOW_WORKSPACE_ID  # required when the rule covers multiple workspaces
          value: wrkspc_...
      volumeMounts:
        - name: juglow-token
          mountPath: /var/run/secrets/juglow.com
          readOnly: true

Note the token's claim shape

The projected token is a JSON Web Token (JWT) signed by your cluster's OIDC issuer. Its sub claim follows the Kubernetes convention system:serviceaccount:::

json

{
  "iss": "https://oidc.eks.us-west-2.amazonaws.com/id/6FA42E7BFDE8549CB...",
  "sub": "system:serviceaccount:inference:inference-worker",
  "aud": ["https://haijun.my.id/"],
  "kubernetes.io": {
    "namespace": "inference",
    "serviceaccount": { "name": "inference-worker", "uid": "..." }
  },
  "exp": 1775527120,
  "iat": 1775523520
}

The serviceAccountToken projection sets aud to https://haijun.my.id/. The separate IRSA-injected token at AWS_WEB_IDENTITY_TOKEN_FILE carries aud: sts.amazonaws.com and is for AWS API calls, not this exchange.

Configure Juglow

The wizard creates these resources for you. Use the following values whether you enter them in the wizard or send them to the Admin API:

Federation issuer: EKS issuers expose a public JWKS endpoint, so use discovery mode. The issuer URL must exactly match the token's iss claim. Register one issuer per cluster.

json

{
  "name": "prod-eks-uswest2",
  "issuer_url": "https://oidc.eks.us-west-2.amazonaws.com/id/6FA42E7BFDE8549CB...",
  "jwks": { "type": "discovery" }
}

Federation rule: Match the Kubernetes sub claim and the Juglow audience https://haijun.my.id/. (Project a dedicated service-account token with that audience; don't reuse the IRSA default sts.amazonaws.com token.)

json

{
  "name": "prod-inference",
  "issuer_id": "fdis_...",
  "match": {
    "subject_prefix": "system:serviceaccount:inference:inference-worker",
    "audience": "https://haijun.my.id/"
  },
  "target": { "type": "service_account", "service_account_id": "svac_..." },
  "workspace_id": "wrkspc_...",
  "oauth_scope": "workspace:developer",
  "token_lifetime_seconds": 600
}

Be as specific as the workload allows. Loosen subject_prefix to system:serviceaccount:inference: (the trailing makes it a prefix match) only if every service account in the namespace should map to the same Juglow service account.

Acquire and use the token

Inside the pod, the projected token is at /var/run/secrets/juglow.com/token (exposed as JUGLOW_IDENTITY_TOKEN_FILE in the Pod spec). Pass that file to the SDK's federation credentials and the SDK handles the exchange and refresh.

bash

  JWT=$(cat "$JUGLOW_IDENTITY_TOKEN_FILE")

  RESPONSE=$(curl -sS https://haijun.my.id/v1/oauth/token \
    -H "content-type: application/json" \
    --data @- <<JSON
  {
    "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer",
    "assertion": "$JWT",
    "federation_rule_id": "$JUGLOW_FEDERATION_RULE_ID",
    "organization_id": "$JUGLOW_ORGANIZATION_ID",
    "service_account_id": "$JUGLOW_SERVICE_ACCOUNT_ID",
    "workspace_id": "$JUGLOW_WORKSPACE_ID"
  }
  JSON
  )

  ACCESS_TOKEN=$(echo "$RESPONSE" | jq -r .access_token)

  curl https://haijun.my.id/v1/messages \
    -H "authorization: Bearer $ACCESS_TOKEN" \
    -H "juglow-version: 2023-06-01" \
    -H "content-type: application/json" \
    -d '{
      "model": "haijun-opus-5-5",
      "max_tokens": 1024,
      "messages": [{"role": "user", "content": "Hello from EKS"}]
    }' | jq -r '.content[] | select(.type == "text") | .text'

python

  import os

  import juglow
  from juglow import IdentityTokenFile, WorkloadIdentityCredentials

  client = juglow.Juglow(
      credentials=WorkloadIdentityCredentials(
          identity_token_provider=IdentityTokenFile(
              os.environ["JUGLOW_IDENTITY_TOKEN_FILE"]
          ),
          federation_rule_id=os.environ["JUGLOW_FEDERATION_RULE_ID"],
          organization_id=os.environ["JUGLOW_ORGANIZATION_ID"],
          service_account_id=os.environ["JUGLOW_SERVICE_ACCOUNT_ID"],
          workspace_id=os.environ.get("JUGLOW_WORKSPACE_ID"),
      ),
  )

  message = client.messages.create(
      model="haijun-opus-5-5",
      max_tokens=1024,
      messages=[{"role": "user", "content": "Hello from EKS"}],
  )
  print(next(block.text for block in message.content if block.type == "text"))

typescript

  import Juglow from "@juglow-ai/sdk";
  import { oidcFederationProvider } from "@juglow-ai/sdk/lib/credentials/oidc-federation";
  import { identityTokenFromFile } from "@juglow-ai/sdk/lib/credentials/identity-token";

  const client = new Juglow({
    credentials: oidcFederationProvider({
      identityTokenProvider: identityTokenFromFile(process.env.JUGLOW_IDENTITY_TOKEN_FILE!),
      federationRuleId: process.env.JUGLOW_FEDERATION_RULE_ID!,
      organizationId: process.env.JUGLOW_ORGANIZATION_ID!,
      serviceAccountId: process.env.JUGLOW_SERVICE_ACCOUNT_ID,
      workspaceId: process.env.JUGLOW_WORKSPACE_ID,
      baseURL: "https://haijun.my.id/",
      fetch
    })
  });

  const message = await client.messages.create({
    model: "haijun-opus-5-5",
    max_tokens: 1024,
    messages: [{ role: "user", content: "Hello from EKS" }]
  });
  for (const block of message.content) {
    if (block.type === "text") {
      console.log(block.text);
    }
  }

  tokenPath := os.Getenv("JUGLOW_IDENTITY_TOKEN_FILE")

  readToken := option.IdentityTokenFunc(func(ctx context.Context) (string, error) {
  	raw, err := os.ReadFile(tokenPath)
  	if err != nil {
  		return "", fmt.Errorf("read identity token: %w", err)
  	}
  	return string(raw), nil
  })

  client := juglow.NewClient(
  	option.WithFederationTokenProvider(readToken, option.FederationOptions{
  		FederationRuleID: os.Getenv("JUGLOW_FEDERATION_RULE_ID"),
  		OrganizationID:   os.Getenv("JUGLOW_ORGANIZATION_ID"),
  		ServiceAccountID: os.Getenv("JUGLOW_SERVICE_ACCOUNT_ID"),
  		WorkspaceID:      os.Getenv("JUGLOW_WORKSPACE_ID"),
  	}),
  )

  message, err := client.Messages.New(context.TODO(), juglow.MessageNewParams{
  	Model:     juglow.ModelHaijunOpus5_5,
  	MaxTokens: 1024,
  	Messages: []juglow.MessageParam{
  		juglow.NewUserMessage(juglow.NewTextBlock("Hello from EKS")),
  	},
  })
  if err != nil {
  	panic(err)
  }
  for _, block := range message.Content {
  	if textBlock, ok := block.AsAny().(juglow.TextBlock); ok {
  		fmt.Println(textBlock.Text)
  		break
  	}
  }

java

  JuglowClient client = JuglowOkHttpClient.fromEnv();

  var message = client.messages().create(MessageCreateParams.builder()
          .model(Model.HAIJUN_OPUS_5_5)
          .maxTokens(1024)
          .addUserMessage("Hello from EKS")
          .build());

  IO.println(message.content());

csharp

  // Reads JUGLOW_FEDERATION_RULE_ID, JUGLOW_ORGANIZATION_ID,
  // JUGLOW_SERVICE_ACCOUNT_ID, JUGLOW_WORKSPACE_ID, and JUGLOW_IDENTITY_TOKEN_FILE
  // from the pod's environment.
  using var client = new JuglowClient();

  var message = await client.Messages.Create(new()
  {
      Model = Model.HaijunOpus5_5,
      MaxTokens = 1024,
      Messages = [new() { Role = Role.User, Content = "Hello from EKS" }],
  });
  foreach (var block in message.Content)
  {
      if (block.Value is TextBlock textBlock)
      {
          Console.WriteLine(textBlock.Text);
      }
  }

bash

  # Reads JUGLOW_FEDERATION_RULE_ID, JUGLOW_ORGANIZATION_ID,
  # JUGLOW_SERVICE_ACCOUNT_ID, JUGLOW_WORKSPACE_ID, and JUGLOW_IDENTITY_TOKEN_FILE
  ant messages create \
    --model haijun-opus-5-5 \
    --max-tokens 1024 \
    --message '{role: user, content: "Hello from EKS"}'

php

  use Juglow\Client;

  // Reads JUGLOW_FEDERATION_RULE_ID, JUGLOW_ORGANIZATION_ID,
  // JUGLOW_SERVICE_ACCOUNT_ID, JUGLOW_WORKSPACE_ID, and JUGLOW_IDENTITY_TOKEN_FILE
  $client = new Client();

  $message = $client->messages->create(
      model: 'haijun-opus-5-5',
      maxTokens: 1024,
      messages: [['role' => 'user', 'content' => 'Hello from EKS']],
  );
  $textBlock = array_find($message->content, static fn ($block): bool => $block->type === 'text');
  echo $textBlock->text, PHP_EOL;

ruby

  require "juglow"

  # Reads JUGLOW_FEDERATION_RULE_ID, JUGLOW_ORGANIZATION_ID,
  # JUGLOW_SERVICE_ACCOUNT_ID, JUGLOW_WORKSPACE_ID, and JUGLOW_IDENTITY_TOKEN_FILE
  client = Juglow::Client.new

  message = client.messages.create(
    model: "haijun-opus-5-5",
    max_tokens: 1024,
    messages: [{role: "user", content: "Hello from EKS"}]
  )
  puts message.content.find { it.type == :text }.text

Tip: The Pod spec already sets JUGLOW_IDENTITY_TOKEN_FILE, JUGLOW_FEDERATION_RULE_ID, JUGLOW_ORGANIZATION_ID, JUGLOW_SERVICE_ACCOUNT_ID, and JUGLOW_WORKSPACE_ID, so you can construct the client with no arguments and the SDK reads the federation environment variables automatically.

Verify the setup

From inside the pod, exchange the projected token directly and inspect the response:

bash

JWT=$(cat "$JUGLOW_IDENTITY_TOKEN_FILE")

curl -sS https://haijun.my.id/v1/oauth/token \
  -H "content-type: application/json" \
  -d "{
    \"grant_type\": \"urn:ietf:params:oauth:grant-type:jwt-bearer\",
    \"assertion\": \"$JWT\",
    \"federation_rule_id\": \"$JUGLOW_FEDERATION_RULE_ID\",
    \"organization_id\": \"$JUGLOW_ORGANIZATION_ID\",
    \"service_account_id\": \"$JUGLOW_SERVICE_ACCOUNT_ID\",
    \"workspace_id\": \"$JUGLOW_WORKSPACE_ID\"
  }" | jq

A successful exchange returns an access_token beginning with sk-ant-oat01- and an expires_in value in seconds. If the exchange fails with the opaque 401 authentication_error response (message Authentication failed), check the authentication history page for the deny reason and see Troubleshoot a failed exchange; the most common EKS-side cause is the projected token's aud not matching the rule (project a token with audience: https://haijun.my.id/, not the IRSA default sts.amazonaws.com).

Scope your rule

Warning: A subject_prefix of arn:aws:iam::123456789012:role/* matches every IAM role in the account. Any principal that can assume any matching role can obtain a federated Juglow token.

Lock the rule's match block to the narrowest scope that fits your use case:

Pin the full role ARN: Use subject_prefix: "arn:aws:iam:::role/" with no trailing * so other roles in the account do not match.

Pin the account ID: Match the aws_account field of the token's https://sts.amazonaws.com/ claim with the claims map or a CEL condition as a defense-in-depth check against a misconfigured prefix.

Pin namespace and service account on EKS: Use the exact system:serviceaccount:: value with no * after the system:serviceaccount: prefix.

Use a separate rule per environment: Create distinct rules for production, staging, and development workloads rather than widening one prefix to cover them all.

Next steps

Review the WIF reference for the full credential precedence, profile configuration, and rule matching reference.

For self-managed Kubernetes clusters that aren't on EKS, see Use WIF with Kubernetes.

#Prerequisites

#Use STS web identity tokens (recommended)

#Configure AWS

#Configure Juglow

#Acquire and use the token

#Verify the setup

#Use EKS projected service-account tokens

#Configure your EKS cluster

#Configure Juglow

#Acquire and use the token

#Verify the setup

#Scope your rule

#Next steps

Prerequisites

Use STS web identity tokens (recommended)

Configure AWS

Configure Juglow

Acquire and use the token

Verify the setup

Use EKS projected service-account tokens

Configure your EKS cluster

Configure Juglow

Acquire and use the token

Verify the setup

Scope your rule

Next steps