- 最新
- 最多得票
- 最多評論
I had the same problem and it was difficult to troubleshoot. My problem appears to have been leaving a trailing slash in the oidc provider URL as part of the identity provider setup.
not working: https://provider.com/endpoint/
working: https://provider.com/endpoint
Changing the trust policy to include the trailing slash did not fix the issue either - the only way I could solve this issue was to delete the OIDC provider and re-create it without the trailing slash.
The exact error message I was seeing:
InvalidIdentityTokenException: An error occurred (InvalidIdentityToken) when calling the AssumeRoleWithWebIdentity operation: No OpenIDConnect provider found in your account for <provider>
The hint was the error message did not display the trailing slash no matter what was in the trust policy.
I think it depends on how you are using it. The aws-sdk may require a non trailing slash. HOWEVER the aws-cli adds the trailing slash automatically. I needed to include the trailing slash in the openid connect provider setup AND the trust policy. This is because the aws cli generates the openid url connect for the user and there is no way to edit that behavior unless you hack the python library underneath.