4

I do POST request to sts AssumeRoleWithWebIdentity to get the access_key, secret_key and token of OIDC(OpenID Connect) using curl command for china region which returns the below error.

An error occurred (InvalidIdentityToken) when calling the AssumeRoleWithWebIdentity operation: Provided Token is not a Login With Amazon token.

curl -v -X POST 'https://sts.cn-northwest-1.amazonaws.com.cn/?Action=AssumeRoleWithWebIdentity&DurationSeconds=3600&RoleSessionName=app1&RoleArn=<ROLE_ARN>&WebIdentityToken=<TOKEN>&Version=2011-06-15&&ProviderId=www.amazon.com'
7hills
  • 131
  • 2
  • 4

2 Answers2

4

After spending few days i found that it is working without ProviderId. The curl URL works without ProviderID, The ProvideId shall be included only incase of OAuth2.0 access tokens not for OPenID Connect.

Aws documentation: AssumeRoleWithWebIdentity Provider The issuing authority of the web identity token presented. For OpenID Connect ID tokens, this contains the value of the iss field. For OAuth 2.0 access tokens, this contains the value of the ProviderId parameter that was passed in the AssumeRoleWithWebIdentity request.

curl -v -X POST 'https://sts.cn-northwest-1.amazonaws.com.cn/?Action=AssumeRoleWithWebIdentity&DurationSeconds=3600&RoleSessionName=app1&RoleArn=<ROLE_ARN>&WebIdentityToken=<TOKEN>&Version=2011-06-15&'
7hills
  • 131
  • 2
  • 4
0

It is happening on our site right now and the cause seems to be AWS being down. :)

Akaisteph7
  • 5,034
  • 2
  • 20
  • 43