iam: OpenIdConnectProvider ignores the @aws-cdk/aws-iam:oidcRejectUnauthorizedConnections feature flag

[tobigumo]

Describe the bug

While running snapshot tests, I noticed that starting from CDK v2.177.0, the GithubActionsProvider resource now includes a RejectUnauthorized property.

According to the feature flags documentation for v2.177.0, a new feature flag called @aws-cdk/aws-iam:oidcRejectUnauthorizedConnections should enable or disable this property.
However, even after enabling the flag, the synthesized template still shows "RejectUnauthorized": false.

    "GithubActionsProvider6504FFAA": {
      "DeletionPolicy": "Delete",
      "Properties": {
        "ClientIDList": [
          "sts.amazonaws.com",
        ],
        "CodeHash": "62fa02efcaa700e1c247e1d3cc2aa0cd07a0808a9a3e3d2230e51f57a02233fb",
+       "RejectUnauthorized": false,
        "ServiceToken": {
          "Fn::GetAtt": [
            "CustomAWSCDKOpenIdConnectProviderCustomResourceProviderHandlerF2C543E0",
            "Arn",
          ],
        },
        "Url": "https://token.actions.githubusercontent.com",
      },

My cdk.json includes the following context:

{
  // ...
  "context": {
    // ...
    "@aws-cdk/aws-iam:oidcRejectUnauthorizedConnections": true
  }
}

Despite setting this flag to true, the resulting CloudFormation template shows "RejectUnauthorized": false.

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Version

No response

Expected Behavior

When @aws-cdk/aws-iam:oidcRejectUnauthorizedConnections is set to true, I would expect the generated template to set "RejectUnauthorized": true.

Current Behavior

The synthesized CloudFormation template retains "RejectUnauthorized": false regardless of the feature flag being enabled.

Reproduction Steps

Below is my code that creates this resource:

import { Stack, type StackProps } from "aws-cdk-lib";
import { type Construct } from "constructs";
import * as iam from "aws-cdk-lib/aws-iam";

export class GithubActionsProvider extends Stack {
  public readonly provider: iam.OpenIdConnectProvider;

  constructor(scope: Construct, id: string, props?: StackProps) {
    super(scope, id, props);

    // create a openid connect provider
    const provider = new iam.OpenIdConnectProvider(
      this,
      "GithubActionsProvider",
      {
        url: "https://token.actions.githubusercontent.com",
        clientIds: ["sts.amazonaws.com"],
      },
    );

    this.provider = provider;
  }
}

Possible Solution

No response

Additional Information/Context

I ran at my macOS and Github Actions' ubuntu-latest

CDK CLI Version

2.177.0 (build b396961)

Framework Version

"aws-cdk-lib": "2.177.0"

Node.js Version

v22.11.0

OS

macOS 15.1.1

Language

TypeScript

Language Version

5.7.3

Other information

No response

[pahud]

I am pertty sure it works in 2.177.0

export class GithubActionsProvider extends Stack {
  public readonly provider: iam.OpenIdConnectProvider;

  constructor(scope: Construct, id: string, props?: StackProps) {
    super(scope, id, props);

    // create a openid connect provider
    const provider = new iam.OpenIdConnectProvider(
      this,
      "GithubActionsProvider",
      {
        url: "https://token.actions.githubusercontent.com",
        clientIds: ["sts.amazonaws.com"],
      },
    );

    this.provider = provider;
  }
}

#!/usr/bin/env node
import 'source-map-support/register';
import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import { GithubActionsProvider } from '../lib/issue-triage-stack';

const devEnv = {
  account: process.env.CDK_DEFAULT_ACCOUNT,
  region: process.env.CDK_DEFAULT_REGION
};

const app = new cdk.App();

new GithubActionsProvider(app, 'GithubActionsProvider', {
  env: devEnv
});

cdk.json

 "@aws-cdk/aws-iam:oidcRejectUnauthorizedConnections": true

% npx cdk synth | grep RejectUnauthorized
RejectUnauthorized: true

or optionally define in the App context

const app = new cdk.App({
  context: {
    '@aws-cdk/aws-iam:oidcRejectUnauthorizedConnections': true
  }
});

% npx cdk synth | grep RejectUnauthorized
RejectUnauthorized: true

% npx cdk version
2.177.0 (build b396961)

% grep aws-cdk-lib package.json
"aws-cdk-lib": "2.177.0",

If you are writing integ tets, you can try specify in App context.

[tobigumo]

Thank you for the suggestion.

As you demonstrated, I confirmed that explicitly specifying the context in the test’s cdk.App causes RejectUnauthorized to be set to false.

I had mistakenly assumed that the flag in cdk.json would also apply during tests.

Thank you again for your help.

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.