Cannot get the AWS federation working.

Question

Hi,

We are facing issues with federating in to AWS using our OIDC isser IDP: iamcredentials.apis-tpczero.goog

Things we have done till now:

Created a identity provider in AWS:
provider: iamcredentials.apis-tpczero.goog
audience: cloud-pubsub-team@cloud-pubsub-prober.tpczero-system.iam.gserviceaccount.com \
Created a role linked with the identity provider above with trust relationshio as:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::077071391996:oidc-provider/iamcredentials.apis-tpczero.goog"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "iamcredentials.apis-tpczero.goog:oaud": "cloud-pubsub-team@cloud-pubsub-prober.tpczero-system.iam.gserviceaccount.com"
                }
            }
        }
    ]
}

NOTE: we tried both using oaud and aud claim above, none worked with federation

Called AWS-STS as:

OPENIDTOKEN=eem.9Qdsfdf.fsddg
ROLE_ARN=arn:aws:iam::077071391996:role/test-iamcreds
PROVIDER_ARN=arn:aws:iam::077071391996:oidc-provider/iamcredentials.apis-tpczero.goog \

curl -X POST "https://sts.amazonaws.com/" -H "Content-Type: application/x-www-form-urlencoded" -d "Action=AssumeRoleWithWebIdentity" -d "Version=2011-06-15" -d "RoleArn=${ROLE_ARN}" -d "RoleSessionName=MyAwsSession" -d "WebIdentityToken=${OPENIDTOKEN}"

where the openidToken has the following payload:

{
  "aud": "cloud-pubsub-team@cloud-pubsub-prober.tpczero-system.iam.gserviceaccount.com",
  "azp": "102661651780308334564",
  "email": "cloud-pubsub-team@cloud-pubsub-prober.tpczero-system.iam.gserviceaccount.com",
  "email_verified": true,
  "exp": 1787089063,
  "iat": 1787085463,
  "iss": "https://iamcredentials.apis-tpczero.goog",
  "sub": "102661651780308334564"
}

The error we get is:

RESPONSE:
<ErrorResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
  <Error>
    <Type>Sender</Type>
    <Code>InvalidIdentityToken</Code>
    <Message>The web identity token provided could not be validated. See the AssumeRoleWithWebIdentity documentation for requirements.</Message>
  </Error>
  <RequestId>2590defe-be6f-4f52-9266-c0685825c62f</RequestId>
</ErrorResponse>

curl -X POST "https://sts.us-east-1.amazonaws.com/" -H "Content-Type: application/x-www-form-urlencoded" -d "Action=AssumeRoleWithWebIdentity" -d "Version=2011-06-15" -d "RoleArn=${ROLE_ARN}" -d "RoleSessionName=MyAwsSession" -d "WebIdentityToken=${OPENIDTOKEN}"

RESPONSE:
<ErrorResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
  <Error>
    <Type>Sender</Type>
    <Code>InvalidIdentityToken</Code>
    <Message>The web identity token provided could not be validated. See the AssumeRoleWithWebIdentity documentation for requirements.</Message>
  </Error>
  <RequestId>ca682f41-cf4c-46d2-8de4-9297656e8889</RequestId>
</ErrorResponse>

Can you help with what is the root cause here?

Riku_Kobayashi · Accepted Answer

Hello.

The JWT you provided contains not only `aud` but also `azp`.  
When an `azp` claim is present in the OIDC token, AWS uses `azp` instead of `aud` as the audience for the IAM OIDC provider.  
This is also explicitly stated in the AWS documentation below.  
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html  
> If your IdP JWT token includes the azp claim, enter this value as the Audience value.  
> If your OIDC identity provider is setting both aud and azp claims in the token, AWS STS will use the value in the azp claim as the aud claim.

So, I think it might be necessary to configure it as follows.  
```
OIDC provider:
  provider: iamcredentials.apis-tpczero.goog
  audience: 102661651780308334564
```

Cannot get the AWS federation working.

Add your answer

Relevant content