{"record":{"id":"4c96266a266d346a","repo":"warpdotdev/warp","slug":"sts-assumerolewithwebidentity-failed-detail-4c9626","errorCode":null,"errorMessage":"STS AssumeRoleWithWebIdentity failed: {detail}","messagePattern":"STS AssumeRoleWithWebIdentity failed: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"app/src/ai/bedrock_credentials.rs","lineNumber":84,"sourceCode":"    let client = sts_client(region).await;\n    let session_name = aws_role_session_name(task_id);\n    let sts_creds = client\n        .assume_role_with_web_identity()\n        .role_arn(role_arn)\n        .role_session_name(&session_name)\n        .web_identity_token(&token.token)\n        .send()\n        .await\n        .map_err(|err| {\n            let detail = err\n                .as_service_error()\n                .map(|e| e.to_string())\n                .unwrap_or_else(|| err.to_string());\n            report_error!(\n                anyhow::Error::new(err)\n                    .context(\"Bedrock OIDC refresh: STS AssumeRoleWithWebIdentity error\")\n            );\n            anyhow::anyhow!(\"STS AssumeRoleWithWebIdentity failed: {detail}\")\n        })?\n        .credentials\n        .context(\"STS response did not include credentials\")?;\n\n    let aws_creds = AwsCredentials::new(\n        sts_creds.access_key_id().to_string(),\n        sts_creds.secret_access_key().to_string(),\n        Some(sts_creds.session_token().to_string()),\n        SystemTime::try_from(*sts_creds.expiration()).ok(),\n    );\n\n    // Step 3: Update ApiKeyManager with the fresh credentials.\n    foreground\n        .spawn(move |_, ctx| {\n            ApiKeyManager::handle(ctx).update(ctx, |manager, ctx| {\n                manager.set_aws_credentials_state(\n                    AwsCredentialsState::Loaded {\n                        credentials: aws_creds,","sourceCodeStart":66,"sourceCodeEnd":102,"githubUrl":"https://github.com/warpdotdev/warp/blob/e72fd7aacbbb2236d9b3be2aad7e7178fe94b4bc/app/src/ai/bedrock_credentials.rs#L66-L102","documentation":"Same STS AssumeRoleWithWebIdentity failure, but on the credential refresh path in bedrock_credentials.rs: it runs when stored Bedrock credentials near expiry and exchanges a web identity token for fresh STS credentials before updating ApiKeyManager (step 3). A failed refresh leaves the manager on the old credentials.","triggerScenarios":"The refresh flow's assume_role_with_webidentity().send() errors: stale OIDC token (long session or clock skew), role/provider changed since login, throttling, or transient STS/network errors (bedrock_credentials.rs:78-88).","commonSituations":"Refresh scheduled too close to token expiry so the token is already invalid; system clock skew; user's role was removed; intermittent STS availability during refresh windows.","solutions":["On InvalidIdentityToken-class failures, force a full Bedrock OIDC re-login instead of retrying refresh","Trigger refresh earlier, before the web identity token's expiry rather than near it","Add bounded retry with backoff for throttling/transient errors","Verify system clock sync (NTP) on machines showing repeated refresh failures"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"if token_near_expiry(&oidc_token, margin) {\n    reauthenticate_oidc().await?; // refresh cannot succeed with a stale token\n}","typeGuard":null,"tryCatchPattern":"match refresh_credentials(&token).await {\n    Err(e) if e.to_string().contains(\"STS AssumeRoleWithWebIdentity failed\") => {\n        if is_invalid_token(&e) {\n            force_full_relogin().await // refresh path is unrecoverable with bad token\n        } else {\n            with_backoff(|| refresh_credentials(&token)).await // throttling/transient\n        }\n    }\n    r => r,\n}","preventionTips":["Trigger refresh well before both the OIDC token and STS credential expiries","Surface refresh failures to prompt re-login instead of silently degrading to old credentials","Keep system clocks NTP-synced on hosts doing token exchange"],"tags":["rust","warp","aws","sts","oidc","bedrock","token-refresh"],"backgroundTag":null,"analyzedSha":"e72fd7aacbbb2236d9b3be2aad7e7178fe94b4bc","analyzedAt":"2026-08-16T08:27:25.381Z","schemaVersion":2},"datasetVersion":"2026-08-16T13:17:31.715Z"}