ChainableTemporaryCredentials getPromise and Missing credentials in config, if using AWS_CONFIG_FILE

Question

I have an node application deployed in GCP. The application includes code to access ressources in AWS-cloud. For this purpose it uses the aws-SDK with ChainableTemporaryCredentials.

The relevant code lines are...

      const credentials = new ChainableTemporaryCredentials({
        params: {
          RoleArn: `arn:aws:iam::${this.accountId}:role/${this.targetRoleName}`,
          RoleSessionName: this.targetRoleName,
        },
        masterCredentials: new WebIdentityCredentials({
          RoleArn: `arn:aws:iam::${this.proxyAccountId}:role/${this.proxyRoleName}`,
          RoleSessionName: this.proxyRoleName,
          WebIdentityToken: token,
        }),
      })

      await credentials.getPromise()

The WebIdentityToken was received from google and looks good. At AWS-side I created an proxy-role (the line from masterCredentials RoleArn).

However at runtime I get the error:

Missing credentials in config, if using AWS_CONFIG_FILE, set AWS_SDK_LOAD_CONFIG=1

I do not understand this error. Because my application runs in GCP and I use temporary credentials I do not understand why I should use aws-credentials in form of an credentials file or environment variables like AWS_ACCESS_KEY_ID or AWS_SECRET_ACCESS_KEY. I thought the idea to use ChainableTemporaryCredentials is NOT to have direct aws-credentials. Right?

You can see the public code at: https://github.com/cloud-carbon-footprint/cloud-carbon-footprint/blob/trunk/packages/aws/src/application/GCPCredentials.ts and documentation regarding env-variables at: https://www.cloudcarbonfootprint.org/docs/configurations-glossary/

Any help which leads to understanding of this error message is welcome.

Thomas

Answer 1

Solved it. "Missing credentials in config, if using AWS_CONFIG_FILE, set AWS_SDK_LOAD_CONFIG=1 was totally misleading." In reality it was a problem with the field-names in the GCP-JWT-token und the policy in aws. See https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_aud