I am trying to Assume a Role through the Powershell AWS SDK using a bearer token that I got from my IDP already. I have a proper IAM Role already set up and can test the entire flow correctly using the Powershell AWS CLI. I cannot use CLI for my end goal for various reasons.
Here is the code I am using with CLI that works
$TOKEN = [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes("Client ID:Client Secret"))
$ACCESS_TOKEN = Invoke-WebRequest -Uri "Issuer URI" -Method POST -Headers @{"accept" = "application/json"; "authorization" = "Basic $TOKEN"; "cache-control" = "no-cache"; "content-type" = "application/x-www-form-urlencoded"} -Body @{"grant_type" = "client_credentials"} | Select-Object -ExpandProperty Content | ConvertFrom-Json | Select-Object -ExpandProperty access_token
aws sts assume-role-with-web-identity --role-arn Role ARN --role-session-name RAQF ID-Session Name --web-identity-token $ACCESS_TOKEN | jq .Credentials
Here is the code I am trying with the SDK (remove private info)
$TOKEN = [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes('clientID:clientsecret'))
$bearerToken = Invoke-WebRequest -Uri 'https://autheserver.com/token' -Method POST -Headers @{"accept" = "application/json"; "authorization" = "Basic $TOKEN"; "cache-control" = "no-cache"; "content-type" = "application/x-www-form-urlencoded"} -Body @{"grant_type" = "client_credentials"} | Select-Object -ExpandProperty Content | ConvertFrom-Json | Select-Object -ExpandProperty access_token
$roleArn = "arn:aws:iam::99999999:role/system-roles/transfer/agent"
$roleSessionName = "99j1925-transfer"
$webIdentityToken = $bearerToken
$stsClient = New-Object -TypeName Amazon.SecurityToken.AmazonSecurityTokenServiceClient
$assumeRoleRequest = New-Object -TypeName Amazon.SecurityToken.Model.AssumeRoleWithWebIdentityRequest -Property @{
RoleArn = $roleArn
RoleSessionName = $roleSessionName
WebIdentityToken = $webIdentityToken
DurationSeconds = 3600
}
$assumeRoleResponse = $stsClient.AssumeRoleWithWebIdentityAsync($assumeRoleRequest)
This returns back an error of:
System.AggregateException: One or more errors occurred. ---> Amazon.Runtime.AmazonServiceException: Unable to get IAM security credentials from EC2 Instance Metadata Service.