ServiceNow to AWS Lambda Integration Using OIDC Authentication

[SoumyaS80315046]

Hi everyone,

I'm currently investigating an integration pattern between ServiceNow and AWS Lambda as part of an account deletion automation initiative.

The current architectural preference is to avoid long-lived AWS IAM user credentials and instead use a more secure federated authentication approach.

We're evaluating whether ServiceNow can securely invoke AWS Lambda using an OIDC-based authentication model, ideally through Integration Hub and the AWS Lambda Spoke.

Some of the questions we're trying to answer are:

• Has anyone successfully implemented direct OIDC authentication between ServiceNow and AWS for Lambda invocation?

• Does the AWS Lambda Spoke support OIDC federation, or does it still require AWS Access Key / Secret Key credentials?

• If direct OIDC is not supported, what patterns have you used to avoid long-lived AWS credentials?

• Has anyone deployed a MID Server within AWS (EC2 or EKS) and used its IAM role to invoke Lambda functions?

• Are there any recommended architectures or lessons learned for ServiceNow → AWS Lambda integrations in security-conscious environments?

Any insights, documentation references, or real implementation experiences would be greatly appreciated.

Thanks in advance.

[Tanushree Maiti]

Hi @SoumyaS80315046 

refer: Federated Token Authentication for ServiceNow API Access (Inbound Authentication)

[Tanushree Maiti]

It is pretty old post. Still have a look: 

ServiceNow Integration with AWS Lambda

[SoumyaS80315046]

Hi Tanushree,

Thanks for the references.

These help on the inbound authentication side (ServiceNow API access via federated tokens), but my current investigation is focused on the outbound integration use case — ServiceNow invoking AWS Lambda via Integration Hub / AWS Lambda Spoke.

Just trying to confirm whether the AWS Lambda Spoke supports any OIDC-based outbound authentication, or if it still relies on IAM-based credentials (Access Key / Secret Key via Connection & Credential Alias).

If OIDC is not supported for this pattern, I’m also trying to validate whether the recommended architecture in such cases is a MID Server deployed in AWS (EC2/EKS) using IAM roles / IRSA for temporary credentials.

Appreciate any clarification from an implementation or architectural perspective.

[Tanushree Maiti]

Hi @SoumyaS80315046 

The AWS Lambda Spoke in ServiceNow natively relies on standard AWS IAM credentials via Connection and Credential Aliases . It seems it does not support OIDC-based outbound authentication

If it helps you -

https://youtu.be/nKk1CRIFQQE?si=OtIy1Aj6z1onyPiA

ServiceNow Documentation: Set up the AWS Lambda spoke