From 6257b1555fc1ed4a3c9f0a9f4ab77cfe80d29f89 Mon Sep 17 00:00:00 2001
From: Waleed Latif <walif6@gmail.com>
Date: Thu, 12 Nov 2026 17:19:11 -0800
Subject: [PATCH] fix(credentials): point the AWS keyless hint at the policy
 audience, quote the docs client ID, and correct a stale comment

---
 apps/docs/content/docs/integrations/aws-credentials.mdx    | 2 +-
 .../connect-service-account-modal/aws-account-modal.tsx    | 2 +-
 .../lib/credentials/databricks-service-account.server.ts   | 7 ++++---
 3 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/apps/docs/content/docs/integrations/aws-credentials.mdx b/apps/docs/content/docs/integrations/aws-credentials.mdx
index 95b3b3d53d9..9a050eb04a0 100644
--- a/apps/docs/content/docs/integrations/aws-credentials.mdx
+++ b/apps/docs/content/docs/integrations/aws-credentials.mdx
@@ -55,7 +55,7 @@ AWS accepts a token only when its audience is one of the identity provider's aud
 ```bash
 aws iam add-client-id-to-open-id-connect-provider \
   --open-id-connect-provider-arn arn:aws:iam::<account ID>:oidc-provider/<issuer host and path> \
-  --client-id <your audience>
+  --client-id '<your audience>'
 ```
 
 A provider holds up to 100 audiences. Once no role relies on `sts.amazonaws.com` any more, you can remove it from the provider. Reconnecting the credential keeps its audience; clearing the field returns it to the default.
diff --git a/apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/aws-account-modal.tsx b/apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/aws-account-modal.tsx
index 571306ea7eb..70dc5dd1782 100644
--- a/apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/aws-account-modal.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/aws-account-modal.tsx
@@ -256,7 +256,7 @@ function AwsAccountForm({
           <ChipModalField
             type='custom'
             title='Role trust policy'
-            hint='Enter the Role ARN first; the policy fills in its account ID. Add the issuer and audience above as an IAM identity provider (once per AWS account; if the provider exists, add the audience to it), set this as the role’s trust policy, then grant the role the permissions your workflows need.'
+            hint='Enter the Role ARN first; the policy fills in its account ID. Add the issuer above and the policy’s aud value as an IAM identity provider audience (once per AWS account; if the provider exists, add the audience to it), set this as the role’s trust policy, then grant the role the permissions your workflows need.'
           >
             {(aria) => (
               <ChipTextarea
diff --git a/apps/sim/lib/credentials/databricks-service-account.server.ts b/apps/sim/lib/credentials/databricks-service-account.server.ts
index 3354bead8dc..9ac606acb4a 100644
--- a/apps/sim/lib/credentials/databricks-service-account.server.ts
+++ b/apps/sim/lib/credentials/databricks-service-account.server.ts
@@ -325,9 +325,10 @@ async function verifyWorkspaceIdentity(
 
 /**
  * Sim signs tokens for any service principal a member names, and every Sim
- * tenant shares the issuer and audience, so a federation policy that matches on
- * a claim other than `sub` (a `subject_claim` of `sim_workspace_id`, say) would
- * let other Sim credentials act as the principal. Exchanging a subject no
+ * tenant shares the issuer and can claim any audience (by default the same one),
+ * so a federation policy that matches on a claim other than `sub` (a
+ * `subject_claim` of `sim_workspace_id`, say) would let other Sim credentials act
+ * as the principal. Exchanging a subject no
  * credential holds must be refused before the credential is saved.
  */
 async function assertPolicyPinsSubject(