diff --git a/api/envoy/extensions/filters/http/aws_request_signing/v3/aws_request_signing.proto b/api/envoy/extensions/filters/http/aws_request_signing/v3/aws_request_signing.proto
index 5729d7f503..ef23e3b664 100644
--- a/api/envoy/extensions/filters/http/aws_request_signing/v3/aws_request_signing.proto
+++ b/api/envoy/extensions/filters/http/aws_request_signing/v3/aws_request_signing.proto
@@ -107,6 +107,24 @@ message AwsRequestSigning {
   // query_string: {}
   //
   QueryString query_string = 7;
+
+  // The credential provider for signing the request. This is optional and if not set,
+  // it will be retrieved from the procedure described in :ref:`config_http_filters_aws_request_signing`.
+  AwsRequestSigningCredentialProvider credential_provider = 8;
+}
+
+message AwsRequestSigningCredentialProvider {
+  oneof provider {
+    AssumeRoleWithWebIdentity assume_role_with_web_identity = 1;
+  }
+
+  message AssumeRoleWithWebIdentity {
+    // The ARN of the role to assume.
+    string role_arn = 1;
+
+    // The identity token that is provided by the identity provider to assume the role.
+    string identity_token = 2;
+  }
 }