feat(credentials): configurable audience for keyless AWS, Databricks, Snowflake, Microsoft, and Google credentials (#9962)

* feat(credentials): configurable audience for keyless AWS, Databricks, Snowflake, Microsoft, and Google credentials

* fix(credentials): check the audience in the connect dialog before showing setup commands

* fix(credentials): name Google's default audience in the keyless catalog hint

Author: waleedlatif1

apps/docs/content/docs/cli/credentials.mdx

@@ -93,6 +93,8 @@ Keyless (workload identity) credentials take two steps.
 
 Step 1: run `sim credentials keyless-subject <providerId> --output json` and configure your cloud to trust the printed issuer, audience, and subject. Its requiredConfigFields lists the values your provider's keylessConfig still needs.
 
+The printed audience is the default. To have Sim sign tokens for your own audience instead, set audience in keylessConfig and trust that value. Google Cloud prints no audience: its default is the credential's own workload identity pool provider.
+
 Step 2: add those values to keylessConfig and pass it to `sim credentials create <providerId> --credentials @file`.
 
 The proof expires after 24 hours and works only for the user who requested it, with the same providerId. If creation reports WORKLOAD_IDENTITY_PROOF_EXPIRED, WORKLOAD_IDENTITY_PROOF_INVALID, WORKLOAD_IDENTITY_SUBJECT_REQUIRED, WORKLOAD_IDENTITY_SUBJECT_IN_USE, run step 1 again, trust the new subject, and retry.
@@ -366,6 +368,8 @@ Keyless (workload identity) credentials take two steps.
 
 Step 1: run `sim credentials keyless-subject <providerId> --output json` and configure your cloud to trust the printed issuer, audience, and subject. Its requiredConfigFields lists the values your provider's keylessConfig still needs.
 
+The printed audience is the default. To have Sim sign tokens for your own audience instead, set audience in keylessConfig and trust that value. Google Cloud prints no audience: its default is the credential's own workload identity pool provider.
+
 Step 2: add those values to keylessConfig and pass it to `sim credentials create <providerId> --credentials @file`.
 
 The proof expires after 24 hours and works only for the user who requested it, with the same providerId. If creation reports WORKLOAD_IDENTITY_PROOF_EXPIRED, WORKLOAD_IDENTITY_PROOF_INVALID, WORKLOAD_IDENTITY_SUBJECT_REQUIRED, WORKLOAD_IDENTITY_SUBJECT_IN_USE, run step 1 again, trust the new subject, and retry.

apps/docs/content/docs/cli/reference.mdx

@@ -780,6 +780,8 @@ Keyless (workload identity) credentials take two steps.
 
 Step 1: run `sim credentials keyless-subject <providerId> --output json` and configure your cloud to trust the printed issuer, audience, and subject. Its requiredConfigFields lists the values your provider's keylessConfig still needs.
 
+The printed audience is the default. To have Sim sign tokens for your own audience instead, set audience in keylessConfig and trust that value. Google Cloud prints no audience: its default is the credential's own workload identity pool provider.
+
 Step 2: add those values to keylessConfig and pass it to `sim credentials create <providerId> --credentials @file`.
 
 The proof expires after 24 hours and works only for the user who requested it, with the same providerId. If creation reports WORKLOAD_IDENTITY_PROOF_EXPIRED, WORKLOAD_IDENTITY_PROOF_INVALID, WORKLOAD_IDENTITY_SUBJECT_REQUIRED, WORKLOAD_IDENTITY_SUBJECT_IN_USE, run step 1 again, trust the new subject, and retry.
@@ -816,6 +818,8 @@ Keyless (workload identity) credentials take two steps.
 
 Step 1: run `sim credentials keyless-subject <providerId> --output json` and configure your cloud to trust the printed issuer, audience, and subject. Its requiredConfigFields lists the values your provider's keylessConfig still needs.
 
+The printed audience is the default. To have Sim sign tokens for your own audience instead, set audience in keylessConfig and trust that value. Google Cloud prints no audience: its default is the credential's own workload identity pool provider.
+
 Step 2: add those values to keylessConfig and pass it to `sim credentials create <providerId> --credentials @file`.
 
 The proof expires after 24 hours and works only for the user who requested it, with the same providerId. If creation reports WORKLOAD_IDENTITY_PROOF_EXPIRED, WORKLOAD_IDENTITY_PROOF_INVALID, WORKLOAD_IDENTITY_SUBJECT_REQUIRED, WORKLOAD_IDENTITY_SUBJECT_IN_USE, run step 1 again, trust the new subject, and retry.

apps/docs/content/docs/integrations/aws-credentials.mdx

@@ -46,13 +46,27 @@ STS **Get Session Token** works only with an **Access keys** credential: AWS ref
   </Step>
 </Steps>
 
+### Use your own audience [#keyless-audience]
+
+Tokens Sim signs for a keyless role carry the audience `sts.amazonaws.com` by default. To have your account accept only tokens issued for it, enter your own **Audience** in the dialog (for example your AWS account ID): up to 255 letters, digits, and `. _ ~ : / ? # @ & + = % -`. The **Role trust policy** then uses it in its `aud` condition.
+
+AWS accepts a token only when its audience is one of the identity provider's audiences (client IDs), so add yours to the provider. In the IAM console, open the provider and choose **Add audience**, or run:
+
+```bash
+aws iam add-client-id-to-open-id-connect-provider \
+  --open-id-connect-provider-arn arn:aws:iam::<account ID>:oidc-provider/<issuer host and path> \
+  --client-id <your audience>
+```
+
+A provider holds up to 100 audiences. Once no role relies on `sts.amazonaws.com` any more, you can remove it from the provider. Reconnecting the credential keeps its audience; clearing the field returns it to the default.
+
 <Callout type="info">
 The subject is unique to the credential. Reconnecting a keyless credential keeps its subject by default, so the role's trust policy keeps working; choose **Issue a new subject** only if you also update the trust policy.
 </Callout>
 
 ### From the API or CLI [#keyless-api-cli]
 
-Run `sim credentials keyless-subject aws-service-account`, trust the printed subject as above, then add `roleArn` (optionally `stsRegion` and `sessionDurationSeconds`) to its `keylessConfig` and pass it to `sim credentials create aws-service-account`. See [the CLI credentials reference](/cli/credentials) for the full two-step example; the proof expires after 24 hours and works only for the user who requested it.
+Run `sim credentials keyless-subject aws-service-account`, trust the printed subject as above, then add `roleArn` (optionally `stsRegion`, `sessionDurationSeconds`, and `audience`) to its `keylessConfig` and pass it to `sim credentials create aws-service-account`. See [the CLI credentials reference](/cli/credentials) for the full two-step example; the proof expires after 24 hours and works only for the user who requested it.
 
 ## Use access keys
 
@@ -80,6 +94,6 @@ Without a signing key, the keyless option is unavailable and access keys work as
 
 ## Troubleshooting
 
-- **`InvalidIdentityToken` or "No OpenIDConnect provider found":** the IAM identity provider's URL or audience doesn't match the dialog exactly, or AWS can't reach the issuer. Open `<issuer>/.well-known/openid-configuration` from outside your network; it must load over `https`.
+- **`InvalidIdentityToken` or "No OpenIDConnect provider found":** the IAM identity provider's URL doesn't match the dialog exactly, its audiences don't include the credential's audience, or AWS can't reach the issuer. Open `<issuer>/.well-known/openid-configuration` from outside your network; it must load over `https`.
 - **"Sim could not assume this role: Not authorized to perform sts:AssumeRoleWithWebIdentity":** the role's trust policy doesn't trust this credential's subject. Paste the trust policy from the dialog again; if you chose **Issue a new subject**, update the policy to the new one.
 - **"This role trusts every Sim subject":** the trust policy is missing the `sub` condition. Use the policy from the dialog.

apps/docs/content/docs/integrations/databricks-credentials.mdx

@@ -29,24 +29,34 @@ Every option resolves on Sim's servers at run time; tokens never appear in block
     In Sim, add a **Databricks connection**, choose **Service principal (keyless, via Sim OIDC)**, and enter the workspace host and the service principal's **application ID**.
   </Step>
   <Step>
-    A Databricks account admin runs the **Federation policy** command from the dialog with the service principal's numeric ID. First sign in to the account with `databricks auth login --host <account console URL> --account-id <account ID>` (not a workspace profile or the workspace web terminal). Find the numeric ID with `databricks account service-principals list --filter 'applicationId eq "<application ID>"'`, or on the service principal's page in the account console. The policy trusts Sim's issuer, the Sim audience, and this connection's subject only.
+    A Databricks account admin runs the **Federation policy** command from the dialog with the service principal's numeric ID. First sign in to the account with `databricks auth login --host <account console URL> --account-id <account ID>` (not a workspace profile or the workspace web terminal). Find the numeric ID with `databricks account service-principals list --filter 'applicationId eq "<application ID>"'`, or on the service principal's page in the account console. The policy trusts Sim's issuer, the audience, and this connection's subject only.
   </Step>
   <Step>
     Make sure the service principal can access the workspace and the resources your workflows use, then save. Sim verifies the connection by exchanging a token and reading the service principal's identity, and refuses a policy that would also trust a different subject, since every Sim workspace shares the issuer and audience.
   </Step>
 </Steps>
 
-Reconnecting a keyless connection keeps its subject by default, so the federation policy keeps working.
+Reconnecting a keyless connection keeps its subject and audience by default, so the federation policy keeps working.
+
+### Use your own audience [#keyless-audience]
+
+By default Sim's tokens carry the audience `sim-databricks`, which every Sim connection shares. To pin the federation policy to a value only your tokens carry, such as your Databricks account ID, enter it in the dialog's **Audience** field before you copy the command. Sim then issues this connection's tokens for that audience, and the command lists it in the policy's `audiences`:
+
+```bash
+databricks account service-principal-federation-policy create <SERVICE_PRINCIPAL_NUMERIC_ID> --json '{"oidc_policy":{"issuer":"<issuer>","audiences":["<your audience>"],"subject":"<subject>"}}'
+```
+
+Databricks accepts any non-empty audience; Sim takes up to 255 letters, digits, and `. _ ~ : / ? # @ & + = % -`, and refuses another cloud's default audience. To change the audience of an existing connection, add the new value to the policy's `audiences` (with `databricks account service-principal-federation-policy update`), then reconnect with it. Clearing the field goes back to the default.
 
 ### From the API or CLI [#keyless-api-cli]
 
-Run `sim credentials keyless-subject databricks-service-account`, trust the printed subject as above, then add `host` and `clientId` to its `keylessConfig` and pass it to `sim credentials create databricks-service-account`. See [the CLI credentials reference](/cli/credentials) for the full two-step example; the proof expires after 24 hours and works only for the user who requested it.
+Run `sim credentials keyless-subject databricks-service-account`, trust the printed subject as above, then add `host` and `clientId` (and optionally `audience`) to its `keylessConfig` and pass it to `sim credentials create databricks-service-account`. See [the CLI credentials reference](/cli/credentials) for the full two-step example; the proof expires after 24 hours and works only for the user who requested it.
 
 ## Self-hosted deployments
 
 Keyless connections need `WORKLOAD_IDENTITY_SIGNING_KEY` set and an `https` issuer Databricks can reach over the public internet. See [AWS credentials](/integrations/aws-credentials#self-hosted-deployments) for the same settings and for rotating the signing key.
 
 ## Troubleshooting
 
-- **"Databricks rejected the token request":** the federation policy's issuer, audience, or subject doesn't match the dialog, or the policy is on a different service principal than the application ID you entered.
+- **"Databricks rejected the token request":** the federation policy's issuer, audience, or subject doesn't match the dialog (the error names the audience Sim sent), or the policy is on a different service principal than the application ID you entered.
 - **"This service principal's federation policy also trusts other Sim credentials":** the policy's `subject_claim` isn't `sub`, so it matches more than this connection. Recreate it with the command from the dialog.

apps/docs/content/docs/integrations/google-service-account.mdx

@@ -218,7 +218,7 @@ Keyless credentials work with Google Cloud APIs that the service account calls a
         --member="principal://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/subject/SUBJECT"
     ```
 
-    The provider sets no allowed audiences, so it accepts its own resource name, which is the **Audience** the dialog shows.
+    By default the provider sets no allowed audiences, so it accepts its own resource name, which Sim's token carries as its `aud`.
   </Step>
   <Step>
     Save in Sim. Sim exchanges a token at STS and impersonates the service account; a token from that step proves the setup works. It also checks that a subject no credential holds can't impersonate the service account, so only this credential can use it. New IAM bindings can take a few minutes to apply; if saving fails right after you run the commands, wait and try again.
@@ -229,13 +229,25 @@ Keyless credentials work with Google Cloud APIs that the service account calls a
 Keep the attribute condition and bind the role to the exact `principal://…/subject/SUBJECT` member. Without the condition, the provider accepts a token for any Sim subject, and a role granted to a `principalSet` for the whole pool would let other Sim credentials act with it. Sim refuses to save a service account that another subject can impersonate, but it can't see roles you grant the pool directly on other resources.
 </Callout>
 
+### Custom audience [#keyless-custom-audience]
+
+To pin the provider to a value of your own instead of its resource name, enter it under **Audience** (up to 255 letters, digits, and `. _ ~ : / ? # @ & + = % -`). Sim's token then carries that value as its `aud`, and the setup commands add it to the provider's [allowed audiences](https://cloud.google.com/iam/docs/reference/rest/v1/projects.locations.workloadIdentityPools.providers#oidc), which then accept only the listed values:
+
+```bash
+gcloud iam workload-identity-pools providers create-oidc PROVIDER_ID \
+    ... \
+    --allowed-audiences="AUDIENCE"
+```
+
+For an existing provider, run `gcloud iam workload-identity-pools providers update-oidc PROVIDER_ID --project="PROJECT_NUMBER" --location="global" --workload-identity-pool="POOL_ID" --allowed-audiences="AUDIENCE"` before reconnecting the credential with the new audience. Sim still exchanges the token at STS for the provider itself. To go back to the default, clear **Audience** and remove the allowed audiences from the provider (or add its resource name, `https://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/providers/PROVIDER_ID`). Another cloud's default audience, such as `sts.amazonaws.com`, is refused.
+
 Each keyless credential has its own subject; reconnecting keeps it by default so your provider and binding keep working. Use one provider per credential (a pool can hold many). Keyless credentials are available for workspace credentials, not organization credentials. Sim uses impersonation rather than direct federated access because some Google Cloud APIs don't accept federated tokens, and impersonation keeps the same identity a JSON key would use.
 
 Self-hosted deployments need `WORKLOAD_IDENTITY_SIGNING_KEY` set and an `https` issuer Google can reach over the public internet. See [AWS credentials](/integrations/aws-credentials#self-hosted-deployments).
 
 ### From the API or CLI [#keyless-api-cli]
 
-Run `sim credentials keyless-subject google-service-account`, trust the printed subject as above, then add `projectNumber`, `poolId`, `providerId`, and `serviceAccountEmail` to its `keylessConfig` and pass it to `sim credentials create google-service-account`. See [the CLI credentials reference](/cli/credentials) for the full two-step example; the proof expires after 24 hours and works only for the user who requested it. For domain-wide delegation, also add `"delegation": {"user": "alice@yourcompany.com", "services": ["gmail", "google-drive"]}`, listing any of `gmail`, `google-drive`, `google-docs`, `google-sheets`, and `google-calendar`.
+Run `sim credentials keyless-subject google-service-account`, trust the printed subject as above, then add `projectNumber`, `poolId`, `providerId`, and `serviceAccountEmail` (and optionally `audience`) to its `keylessConfig` and pass it to `sim credentials create google-service-account`. See [the CLI credentials reference](/cli/credentials) for the full two-step example; the proof expires after 24 hours and works only for the user who requested it. For domain-wide delegation, also add `"delegation": {"user": "alice@yourcompany.com", "services": ["gmail", "google-drive"]}`, listing any of `gmail`, `google-drive`, `google-docs`, `google-sheets`, and `google-calendar`.
 
 ### Keyless domain-wide delegation [#keyless-domain-wide-delegation]
 
@@ -265,7 +277,7 @@ A keyless credential acts only as the Workspace user you entered. A workflow tha
 
 ### Troubleshooting keyless access
 
-- **"Google Cloud refused Sim's token for this workload identity provider":** the project number, pool ID, or provider ID doesn't match; the provider is disabled, has allowed audiences set, or uses a different issuer; or its attribute condition doesn't allow this credential's subject.
+- **"Google Cloud refused Sim's token for this workload identity provider":** the project number, pool ID, or provider ID doesn't match; the provider is disabled or uses a different issuer; its allowed audiences don't accept the credential's audience (with the default, it needs none set, or its own resource name among them; with a custom audience, that value must be listed); or its attribute condition doesn't allow this credential's subject.
 - **"Google Cloud could not fetch the signing keys from Sim's issuer":** the issuer isn't reachable over public HTTPS (self-hosted deployments).
 - **"The service account … does not let this credential impersonate it":** run the `add-iam-policy-binding` command with the exact member shown, and enable the IAM Service Account Credentials API.
 - **"This service account also trusts other Sim credentials":** remove any `principalSet` binding for the pool from the service account and keep the attribute condition.