CDK stopped working after the switch authentication from IAM user to IAM Role (with OIDC)

The error you're encountering suggests that the CDK is unable to determine which AWS account to use for deployment. This issue can occur when switching from IAM user authentication to IAM role authentication, especially when using OIDC (OpenID Connect) for federation. Here are some steps you can take to troubleshoot and resolve this issue:

1. Verify Role Assumption: Ensure that your OIDC setup is correctly allowing the assumption of the IAM role. Check the trust policy of the IAM role to make sure it's properly configured to trust your Bitbucket OIDC provider.

2. Environment Variables: Make sure your CI/CD pipeline is setting the necessary AWS environment variables. When using roles, you typically need to set AWS_ROLE_ARN and AWS_WEB_IDENTITY_TOKEN_FILE instead of AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY.

3. CDK Context: You may need to explicitly specify the account and region in your CDK code. You can do this by passing the environment to your stack:

   new MyStack(app, 'MyStack', {
     env: {
       account: process.env.CDK_DEFAULT_ACCOUNT,
       region: process.env.CDK_DEFAULT_REGION
     }
   });
   

4. AWS CLI Configuration: If you're using AWS CLI in your pipeline, ensure it's configured to use the correct role. You may need to update the AWS CLI configuration file to use the new role.

5. Session Duration: Check if the role's maximum session duration is sufficient for your CDK deployment process. If the session expires before the deployment completes, it could cause issues.

6. Permissions: Verify that the assumed role has the necessary permissions to perform the CDK operations. The role should have permissions to create and manage the resources your CDK stack defines.

7. OIDC Token: Ensure that the OIDC token is being properly generated and passed to AWS. The token should be available at the location specified by AWS_WEB_IDENTITY_TOKEN_FILE.

If you've verified all these points and are still encountering issues, you may need to add some debugging output to your pipeline to see exactly what credentials or lack thereof the CDK is working with. Remember that when switching from IAM users to roles, the way credentials are obtained and used changes significantly, so you may need to adjust your pipeline configuration accordingly.

Sources
Switch from a user to an IAM role (console) - AWS Identity and Access Management
Switch to an IAM role (AWS CLI) - AWS Identity and Access Management
Resolve errors related to OIDC IdP federation in IAM | AWS re:Post