Get AWS Credentials through "GetId" - "GetCredentialsForIdentityCommand" using Google id_token

Question

I am trying to authenticate users through their Gmail account using Identity Pool. I am successfully able to get Google id_token from Google but when I try to get AWS credentials after following this [authentication flow doc](https://docs.aws.amazon.com/cognito/latest/developerguide/authentication-flow.html), it gives me "Token is not from a supported provider of this identity pool." error. I've also tried calling "AssumeRoleWithWebIdentity" but I get "Not authorized to perform sts:AssumeRoleWithWebIdentity" error.
This is the curl command I've used for GetID
```
curl --location 'https://cognito-identity.us-east-1.amazonaws.com' \
--header 'Content-Type:  application/x-amz-json-1.1' \
--header 'X-Amz-Target: AWSCognitoIdentityService.GetId' \
--data '{
    "IdentityPoolId": "us-east-1:",
    "Logins": {
        "accounts.google.com": 
    }
}'
```
I get "Token is not from a supported provider of this identity pool." error for this.

This is the curl command I've used for AssumeRoleWithWebIdentity
```
curl --location 'https://sts.amazonaws.com' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'Action=AssumeRoleWithWebIdentity' \
--data-urlencode 'RoleArn=arn:aws:iam:::role/service-role/' \
--data-urlencode 'RoleSessionName=Mysession' \
--data-urlencode 'WebIdentityToken=' \
--data-urlencode 'Version=2011-06-15'
```
I get "Not authorized to perform sts:AssumeRoleWithWebIdentity" error for this

I've updated the Trust policy to include "accounts.google.com" but still I get this error.
Permissions
```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "cognito-identity:GetCredentialsForIdentity"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}
```

Trust Policy
```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "cognito-identity.amazonaws.com"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "cognito-identity.amazonaws.com:aud": "us-east-1:"
                },
                "ForAnyValue:StringLike": {
                    "cognito-identity.amazonaws.com:amr": "authenticated"
                }
            }
        },
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "accounts.google.com"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "accounts.google.com:aud": ""
                }
            }
        }
    ]
}
```

I've confirmed multiple times that the Client ID (Web) from Google matches the Client ID on Identity Pool. The "aud" in the Google id_token also matches the Google And Identity Pool Client ID.

The documentation says that I can authenticate Google users with only Identity Pool, so I have not created any User pool. I am just using Identity Pool to authenticate users.

Can you please help me to understand what am I doing wrong and what should I try get AWS credentials?

re:Post Agent · Answer

Based on the information you've provided, it seems there are a few areas we can troubleshoot to resolve your issue with authenticating Google users through Amazon Cognito Identity Pools.

1. Identity Pool Configuration:
   Ensure that you have properly configured Google as an authentication provider in your Identity Pool settings. In the AWS Console, go to the Cognito Identity Pools section, select your Identity Pool, and verify that Google is listed as an authentication provider with the correct Google app ID.

2. GetId API Call:
   Your GetId API call looks correct. The error "Token is not from a supported provider of this identity pool" suggests that either the Google provider is not correctly configured in your Identity Pool, or there's an issue with the Google ID token. Double-check that the Google ID token is valid and not expired.

3. AssumeRoleWithWebIdentity:
   The "Not authorized to perform sts:AssumeRoleWithWebIdentity" error indicates a permissions issue. Your trust policy looks mostly correct, but there are a couple of things to check:

a. Ensure that the `` in your trust policy exactly matches the client ID in your Google configuration.
   
   b. The condition for the Google federation in your trust policy uses "accounts.google.com:aud". This should actually be "accounts.google.com:sub" to match the subject (user ID) from the Google token.

4. Authentication Flow:
   Instead of calling AssumeRoleWithWebIdentity directly, you should use the enhanced authentication flow with Cognito Identity. After getting the ID from GetId, use the GetCredentialsForIdentity API. This API handles the role assumption internally and is the recommended way to get credentials when using Cognito Identity Pools.

Here's what you should try:

1. Verify your Identity Pool configuration for Google as an authentication provider.

2. Use the GetId API call as you've done.

3. If GetId is successful, use the returned Identity ID to call GetCredentialsForIdentity. Here's an example curl command:

```
   curl --location 'https://cognito-identity.us-east-1.amazonaws.com' \
   --header 'Content-Type: application/x-amz-json-1.1' \
   --header 'X-Amz-Target: AWSCognitoIdentityService.GetCredentialsForIdentity' \
   --data '{
       "IdentityId": "",
       "Logins": {
           "accounts.google.com": ""
       }
   }'
   ```

This should return temporary AWS credentials that you can use to access AWS services.

4. If you still encounter issues, double-check your IAM role permissions to ensure they allow the necessary Cognito Identity actions.

By following these steps and using the enhanced authentication flow with GetCredentialsForIdentity, you should be able to successfully authenticate Google users and obtain AWS credentials using only an Identity Pool.  
**Sources**  
[Identity pools authentication flow - Amazon Cognito](https://docs.aws.amazon.com/cognito/latest/developerguide/authentication-flow.html)  
[GetCredentialsForIdentity - Amazon Cognito Federated Identities](https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_GetCredentialsForIdentity.html)  
[Getting credentials - Amazon Cognito](https://docs.aws.amazon.com/cognito/latest/developerguide/getting-credentials.html)  
[GetId - Amazon Cognito Federated Identities](https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_GetId.html)  
[Request temporary security credentials - AWS Identity and Access Management](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html)

Get AWS Credentials through "GetId" -> "GetCredentialsForIdentityCommand" using Google id_token

Add your answer

Relevant content