Why i am getting a session token error when i am using aws-actions / configure-aws-credentials in github actions ?

[fjiang-aamc]

Hi
i am getting a Error: The security token included in the request is invalid. when I am using aws-actions / configure-aws-credentials in GHA by following the document. I don't find where can we set up the token or do we need to set it up. below is the code, thank you

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v2
        with:
          aws-access-key-id: ${{ secrets.EVAL_ROLE_USER_ACCESS_KEY }}
          aws-secret-access-key: ${{ secrets.EVAL_ROLE_USER_SECURITY_KEY }}
          aws-region: us-east-1
          role-to-assume: ${{ vars.EVAL_ROLE_ARN_SERVERLESS }}

[peterwoodworth]

Can you post the full workflow file? I'm curious if you're running on a self hosted runner. If so, it would be possible that the self hosted runner has existing AWS keys as environment variables that are causing conflict with this action

[v0ldemar01]

Hey, I have the same issue but I'm using different approach of assuming the role with OIDC provider. That is my configuration:

name: Continuous Delivery Development

on:
  pull_request:
    branches:
      - development
      - production

  workflow_dispatch:

permissions:
  id-token: write
  contents: read

jobs:
  cd:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout Source Code
        uses: actions/checkout@v3

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@master
        with:
          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.AWS_DEPLOY_ROLE }}
          role-session-name: GitHub_to_AWS_via_FederatedOIDC
          aws-region: ${{ secrets.AWS_REGION }}

      # - name: Login to Amazon ECR
      #   id: login-ecr
      #   uses: aws-actions/amazon-ecr-login@v1

      # Hello from AWS: WhoAmI
      - name: Sts GetCallerIdentity
        run: |
          aws sts get-caller-identity

      - name: Build, tag, and push backend image
        uses: whoan/docker-build-with-cache-action@v5
        with:
          image_name: ${{ secrets.ECR_BACKEND_REPOSITORY }}
          registry: ${{ secrets.ECR_REGISTRY }}
          image_tag: ${{ github.sha }}
          context: ./
          dockerfile: ./backend/Dockerfile.development

• name: Build, tag, and push backend image

I was trying to debug it via adding Hello from AWS: WhoAmI and it works fine. These errors appear regardless of Login to Amazon ECR step. I've tried to assign a maximum level of permissions to the role but it didn't help. Can you please assist me? Please let me know if you need more additional input data)

[projects-g]

Same error today. Any fixes yet ?