<p>We have our own Kubernetes cluster built using kops. We are using Azure AD and Dex for authentication. Now we are planning to move to AWS EKS and want to make use of Azure AD so that we do not have to re-create all the users in IAM.</p>
<p>Is there any way to integrate the existing Azure AD with AWS EKS native OIDC?</p>
<p>If yes, can you please help me with the steps or link me to the documentation for the same?</p>
<p>The documentation on AWS needs us to use more of the AWS services and I think that will be anyways a replication of the Azure AD.</p>

Omkar
<p>Interesting question - I have not done this myself so apologies if I am misunderstanding anything. Here are some first impressions from an OAuth viewpoint, having used both providers. I'd be interested in how you get on, since I may be looking into this type of solution in the near future.</p>
<p>Looking at the <a href="https://aws.amazon.com/blogs/containers/introducing-oidc-identity-provider-authentication-amazon-eks/" rel="nofollow noreferrer">AWS EKS OIDC Docs</a> it looks like this should be a case of using the <strong>Associate Identity Provider</strong> option, then entering the Azure AD issuer URL, and possibly adding a '.well-known/openid-configuration' suffix for the metadata endpoint:</p>
<ul>
<li><a href="https://login.microsoftonline.com/tenantid/v2.0" rel="nofollow noreferrer">https://login.microsoftonline.com/tenantid/v2.0</a></li>
</ul>
<p>In your scenario I would aim to totally avoid AWS Cognito and use only Azure AD as your IAM system, since this would cut out a lot of complexity. You then need to test and see if there are any blocking issues.</p>
<p>We always hope that the solutions from the major cloud providers are standards based, but too often vendor specific behaviour means they don't play together nicely - hopefully this one works though.</p>
<p>Another option is to do OIDC federated logins between Cognito and Azure AD, as in <a href="https://authguidance.com/2020/05/23/federation-logins/" rel="nofollow noreferrer">this blog post of mine</a>, where:</p>
<ul>
<li>Cognito acts as the Authorization Server</li>
<li>Azure AD acts as the Identity Provider</li>
</ul>
<p>This would require you to run 2 IAM systems and deal with account linking match ups, so I would use it only as a last resort.</p>
