feat(aws): Add support for externalId in AssumeRole for TriggerAuthentication by Sahar23391 · Pull Request #7388 · kedacore/keda

Sahar23391 · 2026-01-15T12:37:30Z

Description

This PR adds support for passing an external ID when KEDA assumes an AWS role via the TriggerAuthentication resource.

The external ID can be specified using the annotation:

apiVersion: keda.sh/v1alpha1
kind: TriggerAuthentication
metadata:
  name: aws-trigger-auth
  annotations:
    keda.sh/aws-role-external-id: "your-external-id-here"
spec:
  podIdentity:
    provider: aws
    roleArn: "arn:aws:iam::123456789012:role/your-cross-account-role"

The external ID is then passed to AWS STS during the AssumeRole API call, which is required when assuming roles that have an external ID condition in their trust policy. This is a common security pattern for cross-account access.

Changes

Add AwsRoleExternalIdAnnotation constant (keda.sh/aws-role-external-id)
Add AwsRoleExternalId field to AuthorizationMetadata
Update getTriggerAuthSpec to return annotations
Update resolveAuthRef to extract external ID from annotations
Update GetAwsAuthorization to parse external ID from authParams
Update cache key generation to include external ID
Update retrievePodIdentityCredentials to pass ExternalID when assuming role
Update GetAwsConfig to pass ExternalID (deprecated code path)

Checklist

When introducing a new scaler, I agree with the scaling governance policy
I have verified that my change is according to the deprecations & breaking changes policy
Tests have been added
Ensure make generate-scalers-schema has been run to update any outdated generated files.
Changelog has been updated and is aligned with our changelog requirements
A PR is opened to update our Helm chart (repo) (if applicable, ie. when deployment manifests are modified)
A PR is opened to update the documentation on (repo) (if applicable)
Commits are signed with Developer Certificate of Origin (DCO - learn more)

Fixes #

Relates to #

github-actions · 2026-01-15T12:37:41Z

Thank you for your contribution! 🙏

Please understand that we will do our best to review your PR and give you feedback as soon as possible, but please bear with us if it takes a little longer as expected.

While you are waiting, make sure to:

Add an entry in our changelog in alphabetical order and link related issue
Update the documentation, if needed
Add unit & e2e tests for your changes
GitHub checks are passing
Is the DCO check failing? Here is how you can fix DCO issues

Once the initial tests are successful, a KEDA member will ensure that the e2e tests are run. Once the e2e tests have been successfully completed, the PR may be merged at a later date. Please be patient.

Learn more about our contribution guide.

snyk-io · 2026-01-15T12:37:44Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

…tication This change adds support for passing an external ID when KEDA assumes an AWS role via the TriggerAuthentication resource. The external ID can be specified using the annotation: keda.sh/aws-role-external-id: <your-external-id> The external ID is then passed to AWS STS during the AssumeRole API call, which is required when assuming roles that have an external ID condition in their trust policy. Changes: - Add AwsRoleExternalIDAnnotation constant - Add AwsRoleExternalID field to AuthorizationMetadata - Update getTriggerAuthSpec to return annotations - Update resolveAuthRef to extract external ID from annotations - Update GetAwsAuthorization to parse external ID from authParams - Update cache key generation to include external ID - Update retrievePodIdentityCredentials to pass ExternalID when assuming role - Update GetAwsConfig to pass ExternalID (deprecated path) Signed-off-by: sahar23391 <sahar@rocksteady.io>

Copilot

Pull request overview

This PR adds support for specifying an external ID when KEDA assumes AWS IAM roles via TriggerAuthentication resources. The external ID is a security best practice for cross-account role assumption that helps prevent the "confused deputy" problem. Users can now specify the external ID using the annotation keda.sh/aws-role-external-id on their TriggerAuthentication or ClusterTriggerAuthentication resources.

Changes:

Added new annotation constant AwsRoleExternalIDAnnotation for specifying external IDs in TriggerAuthentication
Updated authentication resolution logic to extract and pass external IDs from annotations to AWS authorization metadata
Modified AWS credential caching to include external ID in cache keys, ensuring different external IDs create separate cache entries
Updated AssumeRole API calls to include the external ID parameter when provided

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
apis/keda/v1alpha1/triggerauthentication_types.go	Added `AwsRoleExternalIDAnnotation` constant to define the annotation key for specifying external IDs
pkg/scaling/resolver/scale_resolvers.go	Modified `getTriggerAuthSpec` to return annotations and `resolveAuthRef` to extract external ID from annotations into authParams
pkg/scalers/aws/aws_authorization.go	Added `AwsRoleExternalID` field to `AuthorizationMetadata` struct to store the external ID
pkg/scalers/aws/aws_common.go	Updated `GetAwsAuthorization` to parse external ID from authParams and `GetAwsConfig` to pass external ID to AssumeRole provider
pkg/scalers/aws/aws_config_cache.go	Modified cache key generation to include external ID and updated `retrievePodIdentityCredentials` to pass external ID to AssumeRole API
CHANGELOG.md	Added entry documenting the new external ID support feature

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-01-28T14:51:57Z

pkg/scalers/aws/aws_config_cache.go

+		if roleExternalID != "" {
+			options.ExternalID = &roleExternalID
+		}


The external ID is being applied to the AssumeRole credential provider (lines 170-172). However, this function also uses a WebIdentityRole credential provider as the primary method (before this code, at lines 152-162). If web identity token authentication is being used, the external ID will be ignored. Consider whether the external ID should also be passed to the WebIdentityRoleProvider for consistency, especially if users are using OIDC federation with cross-account access that requires an external ID. The AWS SDK's WebIdentityRoleOptions also supports ExternalID.

If something is resolved, please also provide an explanation as to why something does or does not need to be adjusted.

Copilot · 2026-01-28T14:51:57Z

CHANGELOG.md

 - **General**: Correct error message when awsSecretAccessKey is missing in credential-based authentication ([#7265](https://github.com/kedacore/keda/pull/7265))
 - **General**: Raw metrics stream - include trigger activity status in response ([#7369](https://github.com/kedacore/keda/issues/7369))
 - **AWS CloudWatch Scaler**: Add cross-account observability support ([#7189](https://github.com/kedacore/keda/issues/7189))
+- **AWS Scalers**: Add support for `externalId` in AssumeRole via TriggerAuthentication annotation `keda.sh/aws-role-external-id` ([#XXX](https://github.com/kedacore/keda/issues/XXX))


The CHANGELOG entry is missing the issue number. Please replace ([#XXX](https://github.com/kedacore/keda/issues/XXX)) with the actual issue or pull request number that this change addresses.

Suggested change

- **AWS Scalers**: Add support for `externalId` in AssumeRole via TriggerAuthentication annotation `keda.sh/aws-role-external-id` ([#XXX](https://github.com/kedacore/keda/issues/XXX))

- **AWS Scalers**: Add support for `externalId` in AssumeRole via TriggerAuthentication annotation `keda.sh/aws-role-external-id` (TBD)

This one is not resolved

Copilot · 2026-01-28T14:51:58Z

pkg/scalers/aws/aws_common.go

+		if val, ok := authParams["awsRoleExternalId"]; ok && val != "" {
+			meta.AwsRoleExternalID = val
+		}


No tests have been added to verify the external ID functionality. The codebase has existing test coverage for AWS authorization (e.g., in pkg/scalers/aws/aws_config_cache_test.go and pkg/scalers/kafka_scaler_test.go). Consider adding tests to verify:

Cache key generation includes the external ID (to ensure different external IDs create different cache entries)

GetAwsAuthorization correctly parses the awsRoleExternalId from authParams

The external ID is properly passed to the AssumeRole API call

The annotation extraction in resolveAuthRef works correctly

If something is resolved, please also provide an explanation as to why something does or does not need to be adjusted.

Document the keda.sh/aws-role-external-id annotation for cross-account AssumeRole with external ID support. Relates to kedacore/keda#7388 Signed-off-by: sahar23391 <sahar@rocksteady.io>

JorTurFer · 2026-02-07T23:44:07Z

pkg/scaling/resolver/scale_resolvers.go

 				podIdentity = *triggerAuthSpec.PodIdentity
 			}
+			// Extract AWS role external ID from annotations if present
+			if externalID, ok := triggerAuthAnnotations[kedav1alpha1.AwsRoleExternalIDAnnotation]; ok && externalID != "" {


I'd not use annotation for this but a field in the spec. It's more aligned with current configurations. WDYT @kedacore/keda-core-maintainers @kedacore/keda-core-contributors

Sahar23391 requested a review from a team as a code owner January 15, 2026 12:37

keda-automation requested a review from a team January 15, 2026 12:37

Sahar23391 force-pushed the feat/aws-assume-role-external-id branch 2 times, most recently from 1b9cda6 to b9a0edc Compare January 15, 2026 14:50

Sahar23391 force-pushed the feat/aws-assume-role-external-id branch from b9a0edc to b849499 Compare January 15, 2026 15:45

zroubalik requested a review from Copilot January 28, 2026 14:43

Copilot started reviewing on behalf of zroubalik January 28, 2026 14:43 View session

Copilot AI reviewed Jan 28, 2026

View reviewed changes

rickbrouwer added the needs-resolve-conversation All PR's where a conversation still needs to be resolved label Jan 28, 2026

Sahar23391 added 2 commits February 1, 2026 14:40

Merge branch 'main' into feat/aws-assume-role-external-id

067a6c5

Merge branch 'main' into feat/aws-assume-role-external-id

da78356

Sahar23391 mentioned this pull request Feb 2, 2026

docs: Add AWS external ID annotation documentation kedacore/keda-docs#1702

Open

2 tasks

Merge branch 'main' into feat/aws-assume-role-external-id

02d9708

rickbrouwer added needs-resolve-conversation All PR's where a conversation still needs to be resolved and removed needs-resolve-conversation All PR's where a conversation still needs to be resolved labels Feb 4, 2026

JorTurFer reviewed Feb 7, 2026

View reviewed changes

rickbrouwer added maintainer-input-wanted All PR's or Issues where input from maintainers is desired contributors-input-wanted All PR's or Issues where input from core-contributors is desired labels Feb 8, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Comments

feat(aws): Add support for externalId in AssumeRole for TriggerAuthentication#7388

feat(aws): Add support for externalId in AssumeRole for TriggerAuthentication#7388
Sahar23391 wants to merge 4 commits intokedacore:mainfrom
Sahar23391:feat/aws-assume-role-external-id

Sahar23391 commented Jan 15, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Jan 15, 2026

Uh oh!

snyk-io bot commented Jan 15, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Jan 28, 2026

Uh oh!

rickbrouwer Feb 4, 2026

Uh oh!

Copilot AI Jan 28, 2026

Uh oh!

rickbrouwer Feb 4, 2026

Uh oh!

Copilot AI Jan 28, 2026

Uh oh!

rickbrouwer Feb 4, 2026

Uh oh!

JorTurFer Feb 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	- AWS Scalers: Add support for `externalId` in AssumeRole via TriggerAuthentication annotation `keda.sh/aws-role-external-id` ([#XXX](https://github.com/kedacore/keda/issues/XXX))
	- AWS Scalers: Add support for `externalId` in AssumeRole via TriggerAuthentication annotation `keda.sh/aws-role-external-id` (TBD)

Comments

Conversation

Sahar23391 commented Jan 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Changes

Checklist

Uh oh!

github-actions bot commented Jan 15, 2026

Uh oh!

snyk-io bot commented Jan 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

rickbrouwer Feb 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

rickbrouwer Feb 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

rickbrouwer Feb 4, 2026

Choose a reason for hiding this comment

Uh oh!

JorTurFer Feb 7, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Sahar23391 commented Jan 15, 2026 •

edited

Loading

snyk-io bot commented Jan 15, 2026 •

edited

Loading