credctl setup aws-oidc

Synopsis

credctl setup aws-oidc [flags]

Description

credctl setup aws-oidc creates a public S3 bucket and uploads OIDC discovery documents, providing an OIDC issuer URL without needing a CloudFront distribution.

This is a simpler and cheaper alternative to credctl setup aws, which deploys a full CloudFormation stack with S3 + CloudFront. The trade-off is no CDN caching or DDoS protection, but for individual use this is sufficient.

The issuer URL format is https://{bucket}.s3.{region}.amazonaws.com.

Only the OIDC paths (.well-known/* and keys.json) are publicly readable — the bucket policy scopes access to these objects only.

Flags

Flag	Type	Default	Description
`--bucket`	string	`credctl-oidc-{account-id}`	S3 bucket name.
`--region`	string	`us-east-1`	AWS region.

Examples

Basic setup

credctl setup aws-oidc

Creating S3 bucket 'credctl-oidc-123456789012'...
Configuring public access...
Generating OIDC documents...
Uploading OIDC documents to S3...

AWS OIDC setup complete.
  Issuer URL: https://credctl-oidc-123456789012.s3.us-east-1.amazonaws.com
  Bucket:     s3://credctl-oidc-123456789012

Next: create the IAM OIDC provider and role:
  credctl setup aws --issuer-url https://credctl-oidc-123456789012.s3.us-east-1.amazonaws.com --policy-arn <arn>

Then create the IAM resources

credctl setup aws \
  --issuer-url https://credctl-oidc-123456789012.s3.us-east-1.amazonaws.com \
  --policy-arn arn:aws:iam::123456789012:policy/MyDevPolicy

Custom bucket

credctl setup aws-oidc --bucket my-oidc-bucket --region eu-west-1

Exit codes

Code	Meaning
0	S3 bucket created and OIDC documents uploaded
1	Error (device not initialised, AWS CLI not found, permission denied, or other error)