Support Turbonomic IAM Role Authentication Without Customer‑Side OIDC Requirement

Problem Statement
In large, regulated enterprise environments:
• Adding or approving external OIDC identity providers in AWS accounts is restricted
• Identity provider URLs embedded in IAM trust policies require extensive security review
• Enterprise standards favor explicit cross‑account trust with well‑defined boundaries
• IAM Users are discouraged due to key rotation, lifecycle, and audit complexity
As a result, customers cannot adopt Turbonomic’s IAM Role model even when it is technically available, creating unnecessary security exceptions and operational overhead.

Requested Enhancement
Cross‑Account IAM Role with External ID (No OIDC)
Support a Turbonomic IAM Role authentication model based on:
• AWS STS AssumeRole
• Cross‑account trust between customer AWS accounts and the Turbonomic AWS account
• External ID for confused‑deputy protection
• No OIDC identity provider configuration
High‑Level Model
• Customer creates an IAM Role (e.g., Turbonomic_Access_Role)
• Role trust policy allows assumption by the Turbonomic AWS account
• External ID is required during role assumption
• Turbonomic assumes the role using standard STS APIs
Benefits
• Eliminates customer‑side OIDC provider requirements
• Aligns with long‑standing AWS SaaS access best practices
• Removes reliance on IAM Users and access keys
• Maintains strong, auditable security controls
This model is already widely approved in enterprise AWS environments and should be offered as a first‑class IAM Role option.