As explained here https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc_verify-thumbprint.html AWS OIDC providers require you to whitelist the HTTPS certificate from the OIDC endpoint with a fingerprint.
The issue I am facing is that my AWS OIDC provider stops working whenever the identity provider legitimately rotates their certificate. This happens relatively often.
So, a mitigation that is explained in those docs is to fingerprint CA's certificates instead of the final HTTPS cert. Yet, as far as I understand, fingerprinting the CA's intermediate signing cert could still break my AWS OIDC provider when the CA rotates their operative intermediate cert. This happens every few years.
Then, fingerprinting either the root or the intermediate CA certificates could still break the thing if the identity provider ever changes their CA of choice. This could happen any time.
Multiple fingerprints are permitted by AWS, precisely to handle certificate rotation. But how I am supposed to fingerprint third parties future certificates before they are deployed and already break my AWS OIDC integration?
What is a canonical solution for this?
In the docs there is a note saying that
AWS secures communication with some OIDC identity providers (IdPs) through our library of trusted certificate authorities (CAs) instead of using a certificate thumbprint to verify your IdP server certificate. These OIDC IdPs include Google, and those that use an Amazon S3 bucket to host a JSON Web Key Set (JWKS) endpoint. In these cases, your legacy thumbprint remains in your configuration, but is no longer used for validation.
The external OIDC provider effectively serves a JWKS endpoint linked in the standard .well-known/openid-configuration endpoint, so ideally I'd like to use this. Yet, this is being utterly ignored by AWS because... the third party JWKS endpoint is not hosted in AWS S3??. What am I supposed to do with that at all?