AWS IAM Authentication with Conjur
Enable the Conjur authn-iam authenticator and authenticate a workload to Conjur with a signed AWS STS GetCallerIdentity request, no stored API key required.
Lab Overview
In this lab you configure Conjur OSS v1.24.0 to trust AWS IAM identities through the authn-iam authenticator. The workstation uses the lab AWS pool credentials as its IAM identity, signs an sts:GetCallerIdentity request (the "signed envelope"), and presents it to Conjur. Conjur verifies the signature with AWS, maps the caller ARN to a Conjur host, and mints a short-lived Conjur access token, so the workload fetches a secret without ever holding a Conjur API key. You will also see the denied case when the host id does not match the calling ARN. If STS or IAM access is constrained in your pool account, the lab automatically degrades to a guided scenario (pre-captured signed request plus a policy review) so the authn-iam concepts are still fully taught.
What You'll Learn
Enable the Conjur authn-iam authenticator and load its webservice policy
Define a Conjur host whose id maps to an AWS IAM identity by account and role ARN
Sign an sts:GetCallerIdentity request and exchange it for a Conjur access token
Fetch a permitted secret with the IAM-derived token (no stored Conjur credential)
Observe the denied case when the presented identity does not match the host id
Prerequisites
Completion of the Deploy Conjur OSS with Docker Compose lab (or equivalent familiarity)
Basic AWS IAM concepts (roles, ARNs, STS GetCallerIdentity)
Comfort with the Conjur CLI v8 and policy-as-code YAML
Technologies Covered
Choose your plan
Simple, Transparent Pricing
Unlock full access to TeKanAid courses, labs, and bootcamps
Just exploring? Start free below. Want the full experience? Try Premium free for 7 days (card required, $0 today).
Pro
All courses, with lab scripts to run on your own machine
Renews automatically. Cancel anytime.
Final price verified at checkout.
- Full access to all courses
- Lab scripts to download and run on your own machine (hosted labs not included)
- Progress tracking
- Certificate of completion
- Community access
- Bootcamp participation
- New content access
Premium
Full access, including unlimited hosted labs
Renews automatically. Cancel anytime.
Final price verified at checkout.
- Everything in Pro
- Unlimited hands-on labs, fully hosted on TeKanAid Academy (nothing to set up)
- Lab AI Assistant
- Accelerator bootcamps with live office hours
- Priority support
Prefer a single course?
Purchase individual courses for a one-time fee of $79. Full access to course content, quizzes, certificates, and community features, lab access is not included.
Browse CoursesJust exploring? Start free, no account needed
Three free ways to start. All bridge into the paid Premium catalog when you're ready.
Not ready to commit? The crash course is email-only. No academy account required.
Ready to Get Started?
Start this hands-on lab and build real-world Platform Engineering skills
Get Access Now