Trouble with authenticating to AWS API with Powershell AWS SDK with Federated login

18 Views Asked by At

I am trying to Assume a Role through the Powershell AWS SDK using a bearer token that I got from my IDP already. I have a proper IAM Role already set up and can test the entire flow correctly using the Powershell AWS CLI. I cannot use CLI for my end goal for various reasons.

Here is the code I am using with CLI that works

$TOKEN = [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes("Client ID:Client Secret"))
$ACCESS_TOKEN = Invoke-WebRequest -Uri "Issuer URI" -Method POST -Headers @{"accept" = "application/json"; "authorization" = "Basic $TOKEN"; "cache-control" = "no-cache"; "content-type" = "application/x-www-form-urlencoded"} -Body @{"grant_type" = "client_credentials"} | Select-Object -ExpandProperty Content | ConvertFrom-Json | Select-Object -ExpandProperty access_token

aws sts assume-role-with-web-identity  --role-arn Role ARN   --role-session-name RAQF ID-Session Name  --web-identity-token $ACCESS_TOKEN | jq .Credentials

Here is the code I am trying with the SDK (remove private info)

$TOKEN = [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes('clientID:clientsecret'))
$bearerToken = Invoke-WebRequest -Uri 'https://autheserver.com/token' -Method POST -Headers @{"accept" = "application/json"; "authorization" = "Basic $TOKEN"; "cache-control" = "no-cache"; "content-type" = "application/x-www-form-urlencoded"} -Body @{"grant_type" = "client_credentials"} | Select-Object -ExpandProperty Content | ConvertFrom-Json | Select-Object -ExpandProperty access_token



$roleArn = "arn:aws:iam::99999999:role/system-roles/transfer/agent"
$roleSessionName = "99j1925-transfer"
$webIdentityToken = $bearerToken

$stsClient = New-Object -TypeName Amazon.SecurityToken.AmazonSecurityTokenServiceClient
$assumeRoleRequest = New-Object -TypeName Amazon.SecurityToken.Model.AssumeRoleWithWebIdentityRequest -Property @{
    RoleArn = $roleArn
    RoleSessionName = $roleSessionName
    WebIdentityToken = $webIdentityToken
    DurationSeconds = 3600
}

$assumeRoleResponse = $stsClient.AssumeRoleWithWebIdentityAsync($assumeRoleRequest)

This returns back an error of:

System.AggregateException: One or more errors occurred. ---> Amazon.Runtime.AmazonServiceException: Unable to get IAM security credentials from EC2 Instance Metadata Service.

0

There are 0 best solutions below