0

I'm working on an API Gateway/Lambda-based project. The request flow works as follows:

  • API Gateway passes request to Authorizer lambda
  • Authorizer lambda calls sts.assumeRole() and successfully generates an accessKeyId and secretAccessKey
  • Key/secret are passed to request handler lambda via authorizer context
  • Request handler lambda uses the given accessKeyId/secretAccessKey to attempt to access items from an S3 bucket

Every step of the process is working (confirmed via console log), except for the final one. When I attempt to use the generated credentials, I get the following error message:

   {
      "message": "The AWS Access Key Id you provided does not exist in our records.",
      "code": "InvalidAccessKeyId",
      "region": null,
      "time": "2019-07-19T22:05:05.817Z",
      "requestId": "...",
      "extendedRequestId": "...",
      "statusCode": 403,
      "retryable": false,
      "retryDelay": 68.28400384749038
    }

I know this hints strongly that there's something about STS that I don't understand, but I haven't been able to figure out what. (For example, does AWS de-allocate the generated role when the authorizer lambda finishes running?)

Why would AWS be rejecting a freshly-generated pair of credentials, and report this error message?

1 Answer 1

5

According to the AssumeRole documentation, the returned SessionToken must also be included in any request using the generated credentials.

When you make a call using temporary security credentials, the call must include a session token, which is returned along with those temporary credentials. AWS uses the session token to validate the temporary security credentials.

I had assumed that the generated credentials were exactly like user access keys, and expected the calls to succeed using only those two pieces of information.

1
  • 1
    This is the answer I needed. Most search results are the "check your spelling" kind of problem. It appears that you can't these provided credentials externally to authenticate as a USER. For example, third party integrations where you need to provide the usual (key/secret) pair to access individual items. Assuming a role doesn't produce usable credentials outside of a session that must include the session token. Nov 5, 2021 at 0:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.