I’m having a service running on Google Kubernetes Engine and would like to access an AWS service using Workforce Identity Federation following this guide
I managed already to get the web Identity Token from my google service account and I also tested with an ubuntu-pod with the aws cli installed that it worked so I am positive that the setup is correct.
However when I try to get the AWS credentials from my java application using the SDK it fails to get them.
Caused by: software.amazon.awssdk.core.exception.SdkClientException: Unable to load
credentials from any of the providers in the chain
AwsCredentialsProviderChain(credentialsProviders=[SystemPropertyCredentialsProvider(),
EnvironmentVariableCredentialsProvider(), WebIdentityTokenCredentialsProvider(),
ProfileCredentialsProvider(profileName=default, profileFile=ProfileFile(sections=[])),
ContainerCredentialsProvider(), InstanceProfileCredentialsProvider()]) :
[SystemPropertyCredentialsProvider(): Unable to load credentials from system settings.
Access key must be specified either via environment variable (AWS_ACCESS_KEY_ID) or
system property (aws.accessKeyId)., EnvironmentVariableCredentialsProvider(): Unable to
load credentials from system settings. Access key must be specified either via
environment variable (AWS_ACCESS_KEY_ID) or system property (aws.accessKeyId).,
WebIdentityTokenCredentialsProvider(): Either the environment variable
AWS_WEB_IDENTITY_TOKEN_FILE or the javaproperty aws.webIdentityTokenFile must be set.,
ProfileCredentialsProvider(profileName=default, profileFile=ProfileFile(sections=[])):
Profile file contained no credentials for profile 'default': ProfileFile(sections=[]),
ContainerCredentialsProvider(): Cannot fetch credentials from container - neither
AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI environment
variables are set., InstanceProfileCredentialsProvider(): Failed to load credentials
from IMDS.]
My code is beneath using software.amazon.awssdk:sts:2.26.0:
try (StsClient stsClient = StsClient.builder()
.region(Region.of(appProperties.getAwsRegion()))
.build()) {
AssumeRoleWithWebIdentityRequest request = AssumeRoleWithWebIdentityRequest.builder()
.roleArn(appProperties.getAwsGoogleRoleArn())
.roleSessionName(extractSub(idTokenFromMetadataServer))
.webIdentityToken(idTokenFromMetadataServer)
.build();
AssumeRoleWithWebIdentityResponse response = stsClient.assumeRoleWithWebIdentity(
request);
String accessKey = credentials().accessKeyId();
String secretKey = response.credentials().secretAccessKey();
}
The aws region variable is ‘eu-north-1’