BerriAI/litellm · error · AwsAuthError

AWS STS rejected the web identity token: {e}.{detail}

Error message

AWS STS rejected the web identity token: {e}.{detail}

What it means

Error "AWS STS rejected the web identity token: {e}.{detail}" thrown in BerriAI/litellm.

Source

Thrown at litellm/llms/bedrock/base_aws_llm.py:918

        }
        assume_role_params: Final = {
            "RoleArn": aws_role_name,
            "RoleSessionName": aws_session_name,
            "WebIdentityToken": oidc_token,
            "DurationSeconds": 3600,
            "Policy": json.dumps(bedrock_session_policy, separators=(",", ":")),
        }

        # Add ExternalId parameter if provided
        if aws_external_id is not None:
            assume_role_params["ExternalId"] = aws_external_id

        try:
            sts_response: Final = sts_client.assume_role_with_web_identity(**assume_role_params)
        except sts_client.exceptions.InvalidIdentityTokenException as e:
            audience = self._unverified_web_identity_audience(oidc_token) if isinstance(oidc_token, str) else None
            detail: Final = f" Token {audience}" if audience else ""
            raise AwsAuthError(
                status_code=401,
                message=f"AWS STS rejected the web identity token: {e}.{detail}",
            ) from e

        iam_creds_dict: Final = {
            "aws_access_key_id": sts_response["Credentials"]["AccessKeyId"],
            "aws_secret_access_key": sts_response["Credentials"]["SecretAccessKey"],
            "aws_session_token": sts_response["Credentials"]["SessionToken"],
            "region_name": aws_region_name,
        }

        if sts_response["PackedPolicySize"] > BEDROCK_MAX_POLICY_SIZE:
            verbose_logger.warning(
                "The policy size is greater than 75%% of the allowed size, PackedPolicySize: %s",
                sts_response["PackedPolicySize"],
            )

        with tracer.trace("boto3.Session(**iam_creds_dict)"):

View on GitHub (pinned to 6c2dcb801b)

Solutions

1. Check the web identity token and the IAM role trust policy; see the STS error detail.

When it happens

Trigger: Thrown at litellm/llms/bedrock/base_aws_llm.py:918 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@6c2dcb801b (2026-08-15). Data as JSON: /api/errors/5c792c1bbc04a445. Report an issue: GitHub.