ReleaseBytes
aws AWS What's New ·

Amazon EKS supports AWS PrivateLink for OIDC endpoint

infraawsengineeraws-eksaws-iam
feature

Amazon EKS now supports AWS PrivateLink for its cluster OIDC discovery and JWKS endpoint. This allows tools within your VPC to reach the IAM Roles for Service Accounts (IRSA) endpoint privately, eliminating the need for internet egress. The feature is available in all EKS regions at no additional cost beyond standard PrivateLink pricing.

  • →AWS PrivateLink for EKS OIDC endpoint
  • →Improved IRSA setup and token validation in restricted VPCs
  • →Availability and Pricing
Features (1) ›
  • AWS PrivateLink for EKS OIDC endpoint

    Amazon EKS now supports AWS PrivateLink for the cluster OIDC discovery and JWKS endpoint. This enables private access to the endpoint used by IAM Roles for Service Accounts (IRSA) from within your VPC without requiring internet egress. Tools like eksctl, Terraform, or custom token validators can now use this private connection.

Enhancements (1) ›
  • Improved IRSA setup and token validation in restricted VPCs

    This feature allows for IRSA setup and token validation in VPCs that lack internet egress, enhancing security and network control. It also ensures correct DNS resolution when the EKS management VPC endpoint is enabled with private DNS.

Notes (1) ›
  • Availability and Pricing

    AWS PrivateLink for the cluster OIDC endpoint is available at no additional cost beyond standard AWS PrivateLink pricing in all AWS Regions where Amazon EKS is available. Instructions for getting started can be found in the Amazon EKS User Guide.

Read the original announcement →

https://aws.amazon.com/about-aws/whats-new/2026/07/amazon-eks-oidc-endpoint-privatelink

Related releases