Can't make it work with SSO and derived profile

[gbataille]

Hi team,

I can't make any progress and I'm becoming frustrated.
This is something I have done in the past with python and also my setup works for aws cli, but I can't seem to make it work for Java.

So here is my setup:
I have an SSO identity manager setup on an AWS account, and I want to actually access another account.
my ~/.aws/config looks like that

[profile dev]
source_profile=main
role_arn= arn:aws:iam::xxxxx:role/ReadOnlyAllServices

[profile main]
sso_session = sso
sso_account_id = xxxxxxxx
sso_role_name = AdministratorAccess
region = eu-central-2
output = json
[sso-session sso]
sso_start_url = https://xxx.awsapps.com/start
sso_region = eu-central-2
sso_registration_scopes = sso:account:access

In my java application, I'm using the SDK v2 and I have pulled things like

        <dependency>
            <groupId>software.amazon.awssdk</groupId>
            <artifactId>sso</artifactId>
        </dependency>
        <dependency>
            <groupId>software.amazon.awssdk</groupId>
            <artifactId>ssooidc</artifactId>
        </dependency>
        <dependency>
            <groupId>software.amazon.awssdk</groupId>
            <artifactId>sts</artifactId>
        </dependency>

Now in the application, if I do

        var s3 = S3Client.builder()
                         .region(Region.EU_CENTRAL_2)
                         .credentialsProvider(ProfileCredentialsProvider.create("main"))
                         .build();

using the "direct" profile, it works

However, if I try to use the indirect (assume_role) profile

        var s3 = S3Client.builder()
                         .region(Region.EU_CENTRAL_2)
                         .credentialsProvider(ProfileCredentialsProvider.create("dev"))
                         .build();

I get The security token included in the request is invalid

I'm at a loss there.

using the aws cli, the same profile setup works well.

also when I activate the verbose logs for software.amazon.awssdk I can see that it gets the "original" credentials and then the "assume_role" ones (at least I think that's what I'm seeing).

The following is a trace trying to get to SSM, but I get the same with S3

15:34:46.242 DEBUG 92403 [nio-8080-exec-1] s.a.a.h.a.i.net.SdkSslSocket   : created: portal.sso.eu-central-2.amazonaws.com/16.63.143.233:443
15:34:46.463 DEBUG 92403 [nio-8080-exec-1] s.amazon.awssdk.requestId      : Received successful response: 200, Request ID: ee29ea51-86dd-42c2-8c8e-e826d73c58ef, Extended Request ID: not available
15:34:46.464 DEBUG 92403 [nio-8080-exec-1] s.amazon.awssdk.request        : Received successful response: 200, Request ID: ee29ea51-86dd-42c2-8c8e-e826d73c58ef, Extended Request ID: not available
15:34:46.464 DEBUG 92403 [nio-8080-exec-1] s.a.a.u.cache.CachedSupplier   : (software.amazon.awssdk.services.sso.auth.SsoCredentialsProvider@3ae3878f) Successfully refreshed cached value. Next Prefetch Time: 2024-07-03T01:30:51.704Z. Next Stale Time: 2024-07-03T01:33:45Z
15:34:46.467 DEBUG 92403 [nio-8080-exec-1] .c.i.ExecutionInterceptorChain : Interceptor 'software.amazon.awssdk.services.sts.endpoints.internal.StsRequestSetEndpointInterceptor@d9818d1' modified the message with its modifyHttpRequest method.
15:34:46.468 DEBUG 92403 [nio-8080-exec-1] s.amazon.awssdk.request        : Sending Request: DefaultSdkHttpFullRequest(httpMethod=POST, protocol=https, host=sts.amazonaws.com, encodedPath=, headers=[amz-sdk-invocation-id, Content-Length, Content-Type, User-Agent], queryParameters=[])
15:34:46.470 DEBUG 92403 [nio-8080-exec-1] s.a.a.auth.signer.Aws4Signer   : AWS4 Canonical Request: POST
/

amz-sdk-invocation-id:ecedab6f-f75b-84f9-6f4c-76ccd50477df
amz-sdk-request:attempt=1; max=4
content-length:160
content-type:application/x-www-form-urlencoded; charset=utf-8
host:sts.amazonaws.com
x-amz-date:20240702T133446Z
x-amz-security-token:XXXXXXXXXXXXXXGEre48LGBJTPRoNSR2+1IKmjjjBgikM1AEt6YJoMrAlAiEApABDxcEb1VIyoAZvifNPJ9QnIgkJLl9fedTA6TUbDIgq5gIIXXXXXXXXXXXXXXCcHjWTPYQPH/bAt39co6a+KNtbfjPqxHlSLKyibnkm7ZTkvj95sQQDFNfx4m7SC0gGCn7LgloZT+Y1M+qHvoYdOgqtdNUnnwQrWUYBRmLFLairbgvVmrmcTLVSfmjc5u69Y3P8KZGsWgQmik/YZ4MdUw6dmgEu3JwKDj0z6v+w2NNxOSBYEIuBjyXSQabuaztJfobsaXXXXXXXZ5f6sUkqcTzx+SQcHrB4sGMPaDkLQGOqcBFckHLxag9sCOpTBy7EiMZ/HCcTzchUVINgvGd6w4o9eizZUQGS/tbkDKupDCWUXchEIpjRJIi/vlTBXRNVQED2kBGwqYdmXq0V7NXXXXXXXXXnU4Qr4UeKndPwoRHmlKMO0ji56tnB2PuPJDUyQELCOiScxRWSFGG2m5k78aqoLFEUx4VpfF8cz6fCwZ7MxrfyfFLXbqz7kk3rJBdzymmXXXXXXXXXXXXXXXXX=

amz-sdk-invocation-id;amz-sdk-request;content-length;content-type;host;x-amz-date;x-amz-security-token
a27aaee1eXXXXXXXXXXXXXXXXXXc20beb3896aa57d69a
15:34:46.470 DEBUG 92403 [nio-8080-exec-1] s.a.a.auth.signer.Aws4Signer   : AWS4 String to sign: AWS4-HMAC-SHA256
20240702T133446Z
20240702/us-east-1/sts/aws4_request
bbe61e2955a8ad3557980dff357213b637d724624cfd778e63e3b8c81f3ad1f6
15:34:46.474 DEBUG 92403 [nio-8080-exec-1] .a.h.a.i.c.SdkTlsSocketFactory : Connecting socket to sts.amazonaws.com/209.54.177.164:443 with timeout 2000
15:34:46.590 DEBUG 92403 [nio-8080-exec-1] .a.h.a.i.c.SdkTlsSocketFactory : Enabled protocols: [TLSv1.3, TLSv1.2]
15:34:46.590 DEBUG 92403 [nio-8080-exec-1] .a.h.a.i.c.SdkTlsSocketFactory : Enabled cipher suites:[TLS_AES_256_GCM_SHA384, TLS_AES_128_GCM_SHA256, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_DHE_DSS_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_DSS_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, TLS_DHE_DSS_WITH_AES_256_CBC_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_DSS_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_DSS_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV]
15:34:46.590 DEBUG 92403 [nio-8080-exec-1] .a.h.a.i.c.SdkTlsSocketFactory : socket.getSupportedProtocols(): [TLSv1.3, TLSv1.2, TLSv1.1, TLSv1, SSLv3, SSLv2Hello], socket.getEnabledProtocols(): [TLSv1.3, TLSv1.2]
15:34:46.590 DEBUG 92403 [nio-8080-exec-1] .a.h.a.i.c.SdkTlsSocketFactory : Starting handshake
15:34:46.736 DEBUG 92403 [nio-8080-exec-1] .a.h.a.i.c.SdkTlsSocketFactory : Secure session established
15:34:46.736 DEBUG 92403 [nio-8080-exec-1] .a.h.a.i.c.SdkTlsSocketFactory :  negotiated protocol: TLSv1.3
15:34:46.736 DEBUG 92403 [nio-8080-exec-1] .a.h.a.i.c.SdkTlsSocketFactory :  negotiated cipher suite: TLS_AES_128_GCM_SHA256
15:34:46.737 DEBUG 92403 [nio-8080-exec-1] .a.h.a.i.c.SdkTlsSocketFactory :  peer principal: CN=sts.amazonaws.com
15:34:46.737 DEBUG 92403 [nio-8080-exec-1] .a.h.a.i.c.SdkTlsSocketFactory :  peer alternative names: [*.sts.global.vpce.amazonaws.com, sts.amazonaws.com]
15:34:46.737 DEBUG 92403 [nio-8080-exec-1] .a.h.a.i.c.SdkTlsSocketFactory :  issuer principal: CN=Amazon RSA 2048 M01, O=Amazon, C=US
15:34:46.737 DEBUG 92403 [nio-8080-exec-1] s.a.a.h.a.i.net.SdkSslSocket   : created: sts.amazonaws.com/209.54.177.164:443
15:34:46.880 DEBUG 92403 [nio-8080-exec-1] s.amazon.awssdk.requestId      : Received successful response: 200, Request ID: ba5ac6fd-308a-4dab-8498-16e9d213c748, Extended Request ID: not available
15:34:46.880 DEBUG 92403 [nio-8080-exec-1] s.amazon.awssdk.request        : Received successful response: 200, Request ID: ba5ac6fd-308a-4dab-8498-16e9d213c748, Extended Request ID: not available
15:34:46.892 DEBUG 92403 [nio-8080-exec-1] s.a.a.u.cache.CachedSupplier   : (StsAssumeRoleCredentialsProvider()) Successfully refreshed cached value. Next Prefetch Time: 2024-07-02T14:31:06.046Z. Next Stale Time: 2024-07-02T14:33:46Z
15:34:46.892 DEBUG 92403 [nio-8080-exec-1] a.s.s.a.StsCredentialsProvider : Using STS credentials with expiration time of 2024-07-02T14:34:46Z
15:34:46.897 DEBUG 92403 [nio-8080-exec-1] .c.i.ExecutionInterceptorChain : Interceptor 'software.amazon.awssdk.services.ssm.endpoints.internal.SsmRequestSetEndpointInterceptor@1f460290' modified the message with its modifyHttpRequest method.
15:34:46.898 DEBUG 92403 [nio-8080-exec-1] s.amazon.awssdk.request        : Sending Request: DefaultSdkHttpFullRequest(httpMethod=POST, protocol=https, host=ssm.eu-central-2.amazonaws.com, encodedPath=/, headers=[amz-sdk-invocation-id, Content-Length, Content-Type, User-Agent, X-Amz-Target], queryParameters=[])
15:34:46.899 DEBUG 92403 [nio-8080-exec-1] .i.i.SdkLengthAwareInputStream : Specified InputStream length of 2 has been reached. Returning EOF.
15:34:46.899 DEBUG 92403 [nio-8080-exec-1] s.a.a.auth.signer.Aws4Signer   : AWS4 Canonical Request: POST
/

amz-sdk-invocation-id:8446c42a-970b-e240-730d-ef7a753c2b2e
amz-sdk-request:attempt=1; max=4
content-length:2
content-type:application/x-amz-json-1.1
host:ssm.eu-central-2.amazonaws.com
x-amz-date:20240702T133446Z
x-amz-security-token:FwoGZXIvYXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX0OM6Zi8VRTVk2CbvLeTXTVpO1lENoraTAQDw==
x-amz-target:AmazonSSM.DescribeParameters

amz-sdk-invocation-id;amz-sdk-request;content-length;content-type;host;x-amz-date;x-amz-security-token;x-amz-target
44136fa355b3678XXXXXXXXXXXXXXXXXXX7e8310c060f61caaff8a
15:34:46.899 DEBUG 92403 [nio-8080-exec-1] s.a.a.auth.signer.Aws4Signer   : AWS4 String to sign: AWS4-HMAC-SHA256
20240702T133446Z
20240702/eu-central-2/ssm/aws4_request
40d7fe006a5654bc3cXXXXXXXXXXXXXXXXXXXXXXXfedb145eb6331cd

any idea anyone?