dry-journalist-60579
03/08/2023, 10:49 PMError: fetching AWS credentials: WebIdentityErr: failed to retrieve credentials, caused by: AccessDenied: Not authorized to perform sts:AssumeRoleWithWebIdentity, status code: 403
Any ideas?
I’m using Pulumi to create the OIDC configuration and AWS roles:
import pulumi_aws as aws
import json
# Create OIDC provider for Pulumi Deployments
oidc_provider = aws.iam.OpenIdConnectProvider(
"Pulumi OIDC Provider",
client_id_lists=["MYORG"],
# <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc_verify-thumbprint.html>
thumbprint_lists=["9E99A48A9960B14926BB7F3B02E22DA2B0AB7280"],
url="<https://api.pulumi.com/oidc>",
)
oidc_provider_role = aws.iam.Role(
"Pulumi OIDC Provider Role",
name="PulumiOIDC",
assume_role_policy=oidc_provider.arn.apply(
lambda arn: json.dumps(
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Federated": arn,
},
"Action": "sts:AssumeRoleWithWebIdentity",
"Condition": {
"StringEquals": {
"<http://api.pulumi.com/oidc:aud|api.pulumi.com/oidc:aud>": "MYORG",
"<http://api.pulumi.com/oidc:sub|api.pulumi.com/oidc:sub>": "pulumi:deploy:org:MYORG:project:*:*",
}
},
}
],
}
)
),
)
delightful-salesclerk-16161
03/08/2023, 10:50 PMdry-journalist-60579
03/08/2023, 10:54 PMdelightful-salesclerk-16161
03/08/2023, 10:55 PMdry-journalist-60579
03/08/2023, 10:56 PMmanaged_policy_arns
?delightful-salesclerk-16161
03/08/2023, 10:57 PMdry-journalist-60579
03/08/2023, 10:57 PM["arn:aws:iam::aws:policy/AdministratorAccess"]
delightful-salesclerk-16161
03/08/2023, 10:57 PMdry-journalist-60579
03/08/2023, 11:05 PMdelightful-salesclerk-16161
03/08/2023, 11:06 PMdry-journalist-60579
03/08/2023, 11:06 PM{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Federated": "arn:aws:iam::<ACCOUNT-ID>:oidc-provider/api.pulumi.com/oidc"
},
"Action": "sts:AssumeRoleWithWebIdentity",
"Condition": {
"StringEquals": {
"<http://api.pulumi.com/oidc:aud|api.pulumi.com/oidc:aud>": "<PULUMI-ORG>",
"<http://api.pulumi.com/oidc:sub|api.pulumi.com/oidc:sub>": "pulumi:deploy:org:<PULUMI-ORG>:project:*:*"
}
}
}
]
}
delightful-salesclerk-16161
03/08/2023, 11:10 PMdry-journalist-60579
03/08/2023, 11:11 PMdelightful-salesclerk-16161
03/08/2023, 11:14 PMdry-journalist-60579
03/08/2023, 11:50 PM