- Newest
- Most votes
- Most comments
Hello,
Thank you for reaching out to us.
As per error message displayed, the issue could be with IAM roles assigned to your identity pool. However, such error messages are also displayed if we try to add a Tag key for principal which tries to reference an Attribute name represented as array within your Id Token.
For example: If we try to map Attribute names such as "cognito:roles" and "cognito:groups" which are passed as array elements in JWT Id token, in such cases we receive this errors.
Sample decoded Id token showing array elements which cannot be referenced in Attribute name:
"cognito:groups": [
"test-group"
]
"cognito:roles": [
"arn:aws:iam::1234567890:role/test-role"
]
This is because the custom mapping for identity pool cannot parse the array elements.
In case if you are facing this error message for a specific scenario apart from the one discussed above then please feel free to create a case with us to get it examined for errors.
Relevant content
- Accepted Answerasked 3 months ago
AWS OFFICIALUpdated 7 months ago- AWS OFFICIALUpdated 6 months ago
- AWS OFFICIALUpdated 10 months ago
- AWS OFFICIALUpdated a year ago
Hello Vinay, thanks for your support. Actually I have two questions on this.
If I can just remove the principal tag from identity-pool, I am not getting this error, I can successfully create AWS credentials using getCredentialsForIdentity() API, so if this is an IAM role issue, should not i face this issue every time?!
I am not trying to add a Tag key for principal which tries to reference an Attribute name represented as array within my Id Token. I am trying to reference an attribute named custom:org_id, which is a string located in a payload object. Sharing the object structure with you as well. { "status": 201, "message": { "idToken": { "jwtToken": "...", "payload": { "sub": "...", "email_verified": true, "iss": "...", "custom:org_id": "bt001arnab51", "cognito:username": "...", "origin_jti": "...", "aud": "...", "event_id": "...", "token_use": "id", "auth_time": 1681973893, "exp": 1681977493, "iat": 1681973893, "jti": "...", "email": "..." } }, "refreshToken": { "token": "..." }, "accessToken": { "jwtToken": "...", "payload": { ... } }, "clockDrift": 0 } }
Can you please help me with this?! And if I need to create a case, can you let me know, how can I do that?! Thanks in advance.