# OidcProviderNativeProps

Initialization properties for `OidcProviderNative`.

Extends: OidcProviderNativeProps
Extends: OpenIdConnectProviderProps
Used as props by: OidcProviderNative

- Source: [`aws-eks/lib/oidc-provider.ts`](https://github.com/aws/aws-cdk/blob/v2.274.0/packages/aws-cdk-lib/aws-eks/lib/oidc-provider.ts#L34)
- Type last changed: v2.237.0 · 2 Feb 2026

## Example

```ts
// you can import an existing provider
const provider = eks.OidcProviderNative.fromOidcProviderArn(this, 'Provider', 'arn:aws:iam::123456:oidc-provider/oidc.eks.eu-west-1.amazonaws.com/id/AB123456ABC');

// or create a new one using an existing issuer url
declare const issuerUrl: string;
const provider2 = new eks.OidcProviderNative(this, 'Provider', {
  url: issuerUrl,
});

const cluster = eks.Cluster.fromClusterAttributes(this, 'MyCluster', {
  clusterName: 'Cluster',
  openIdConnectProvider: provider,
  kubectlRoleArn: 'arn:aws:iam::123456:role/service-role/k8sservicerole',
});

const serviceAccount = cluster.addServiceAccount('MyServiceAccount');

const bucket = new s3.Bucket(this, 'Bucket');
bucket.grantReadWrite(serviceAccount);
```

## Properties

- `removalPolicy`: [RemovalPolicy](/cdk/api/v2/docs/aws-cdk-lib.RemovalPolicy.html) = RemovalPolicy.DESTROY — The removal policy to apply to the OpenID Connect Provider.

- `url`: string (required) — The URL of the identity provider.

  The URL must begin with https:// and
  should correspond to the iss claim in the provider's OpenID Connect ID
  tokens. Per the OIDC standard, path components are allowed but query
  parameters are not. Typically the URL consists of only a hostname, like
  https://server.example.org or https://example.com.

  You can find your OIDC Issuer URL by:
  aws eks describe-cluster --name %cluster_name% --query "cluster.identity.oidc.issuer" --output text