AWS trust relationship for Vault

trust-relation.json

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::0000000000000:oidc-provider/oidc-test-XXXXXXXX.amazonaws.com/v1/identity/oidc"
            },
            "Action": [
                "sts:AssumeRoleWithWebIdentity",
                "sts:TagSession"
            ],
            "Condition": {
                "StringEquals": {
                    "XXXXXX.amazonaws.com/v1/identity/oidc:aud": "sts.amazon.com"
                },
                "StringLike": {
                    "aws:RequestTag/department": "*"
                }
            }
        }
    ]
 }