{"record":{"id":"5c792c1bbc04a445","repo":"BerriAI/litellm","slug":"aws-sts-rejected-the-web-identity-token-e-deta","errorCode":null,"errorMessage":"AWS STS rejected the web identity token: {e}.{detail}","messagePattern":"AWS STS rejected the web identity token: (.+?)\\.(.+?)","errorType":"exception","errorClass":"AwsAuthError","httpStatus":401,"severity":"error","filePath":"litellm/llms/bedrock/base_aws_llm.py","lineNumber":918,"sourceCode":"        }\n        assume_role_params: Final = {\n            \"RoleArn\": aws_role_name,\n            \"RoleSessionName\": aws_session_name,\n            \"WebIdentityToken\": oidc_token,\n            \"DurationSeconds\": 3600,\n            \"Policy\": json.dumps(bedrock_session_policy, separators=(\",\", \":\")),\n        }\n\n        # Add ExternalId parameter if provided\n        if aws_external_id is not None:\n            assume_role_params[\"ExternalId\"] = aws_external_id\n\n        try:\n            sts_response: Final = sts_client.assume_role_with_web_identity(**assume_role_params)\n        except sts_client.exceptions.InvalidIdentityTokenException as e:\n            audience = self._unverified_web_identity_audience(oidc_token) if isinstance(oidc_token, str) else None\n            detail: Final = f\" Token {audience}\" if audience else \"\"\n            raise AwsAuthError(\n                status_code=401,\n                message=f\"AWS STS rejected the web identity token: {e}.{detail}\",\n            ) from e\n\n        iam_creds_dict: Final = {\n            \"aws_access_key_id\": sts_response[\"Credentials\"][\"AccessKeyId\"],\n            \"aws_secret_access_key\": sts_response[\"Credentials\"][\"SecretAccessKey\"],\n            \"aws_session_token\": sts_response[\"Credentials\"][\"SessionToken\"],\n            \"region_name\": aws_region_name,\n        }\n\n        if sts_response[\"PackedPolicySize\"] > BEDROCK_MAX_POLICY_SIZE:\n            verbose_logger.warning(\n                \"The policy size is greater than 75%% of the allowed size, PackedPolicySize: %s\",\n                sts_response[\"PackedPolicySize\"],\n            )\n\n        with tracer.trace(\"boto3.Session(**iam_creds_dict)\"):","sourceCodeStart":900,"sourceCodeEnd":936,"githubUrl":"https://github.com/BerriAI/litellm/blob/6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d/litellm/llms/bedrock/base_aws_llm.py#L900-L936","documentation":"Error \"AWS STS rejected the web identity token: {e}.{detail}\" thrown in BerriAI/litellm.","triggerScenarios":"Thrown at litellm/llms/bedrock/base_aws_llm.py:918 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check the web identity token and the IAM role trust policy; see the STS error detail."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d","analyzedAt":"2026-08-15T07:12:03.035Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}