assume-role-with-web-identity gets invalid credentials

Question

I am trying to use OpenID Connect authentication. I created my identity provider and am able to retrieve credentials using `aws sts assume-role-with-web-identity`, but when I try making requests with the token that comes back, I just get this error: `An error occurred (InvalidClientTokenId) when calling the GetCallerIdentity operation: The security token included in the request is invalid.`

## Setup
### Identity Provider
- name: gitlab.com
- audience: https://gitlab.com

#### Trust Relationship
```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::{account id}:oidc-provider/gitlab.com"
            },
            "Action": [
                "sts:AssumeRoleWithWebIdentity",
                "sts:TagSession"
            ],
            "Condition": {
                "StringLike": {
                    "gitlab.com:sub": "project_path:{redacted}/*:ref_type:branch:ref:*"
                }
            }
        }
    ]
}
```

### Role Policy

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "sts:GetCallerIdentity"
            ],
            "Resource": [
                "*"
            ]
        },
        {...excluded}
    ]
}
```

### Steps
```
aws sts assume-role-with-web-identity \
--role-arn arn:aws:iam::{account id}:role/app-deploy \
--role-session-name "GitLabRunner-${CI_PROJECT_ID}-${CI_PIPELINE_ID}" \
--web-identity-token $CI_JOB_JWT_V2 \
--duration-seconds 3600 >> secrets
```
```
export AWS_ACCESS_KEY_ID="$(cat secrets | jq '.Credentials.AccessKeyId')"
export AWS_SECRET_ACCESS_KEY="$(cat secrets | jq '.Credentials.SecretAccessKey')"
export AWS_SESSION_TOKEN="$(cat secrets | jq '.Credentials.SessionToken')"
export AWS_SECURITY_TOKEN="$AWS_SESSION_TOKEN"
export AWS_DEFAULT_REGION="us-east-2"
```
The error is then thrown when running `aws sts get-caller-identity`

Accepted Answer

Hello,

The problem is the `jq` config, you need to add `--raw-output` flag like this:

```
export AWS_ACCESS_KEY_ID="$(cat secrets | jq '.Credentials.AccessKeyId' --raw-output)"
export AWS_SECRET_ACCESS_KEY="$(cat secrets | jq '.Credentials.SecretAccessKey' --raw-output)"
export AWS_SESSION_TOKEN="$(cat secrets | jq '.Credentials.SessionToken' --raw-output)"
```

Otherwise, the environment variables get wrapped in `""` which does not work.

Hope it helps!

//Carl

Answer

Hello,

Errors like these could be due to issues with things like environment variables or ~/.aws/credentials conflicting in weird ways with IAM instance profiles. The cleanest test would be to unset the relevant environment variables first:

$ for var in AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN AWS_SECURITY_TOKEN ; do eval unset $var ; done

and also ensure that you have nothing in ~/.aws/config or ~/.aws/credentials, then rerun the test.

Let me know if this helps and what was the result by clicking Accept answer.

assume-role-with-web-identity gets invalid credentials

Setup

Identity Provider

Trust Relationship

Role Policy

Steps

Relevant content