{"record":{"id":"88de574155b14a2a","repo":"warpdotdev/warp","slug":"sts-assumerolewithwebidentity-failed-detail","errorCode":null,"errorMessage":"STS AssumeRoleWithWebIdentity failed: {detail}","messagePattern":"STS AssumeRoleWithWebIdentity failed: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"app/src/ai/aws_credentials.rs","lineNumber":372,"sourceCode":"            let session_name = aws_role_session_name(&task_id);\n            let credentials = client\n                .assume_role_with_web_identity()\n                .role_arn(&role_arn)\n                .role_session_name(session_name)\n                .web_identity_token(token.token)\n                .send()\n                .await\n                .map_err(|err| {\n                    // Surface the AWS service error message for a user-friendly error.\n                    let detail = err\n                        .as_service_error()\n                        .map(|e| e.to_string())\n                        .unwrap_or_else(|| err.to_string());\n                    report_error!(\n                        anyhow::Error::new(err)\n                            .context(\"Bedrock OIDC: STS AssumeRoleWithWebIdentity SDK error\")\n                    );\n                    anyhow::anyhow!(\"STS AssumeRoleWithWebIdentity failed: {detail}\")\n                })?\n                .credentials\n                .context(\"STS response did not include credentials\")?;\n\n            anyhow::Ok(AwsCredentials::new(\n                credentials.access_key_id().to_string(),\n                credentials.secret_access_key().to_string(),\n                Some(credentials.session_token().to_string()),\n                SystemTime::try_from(*credentials.expiration()).ok(),\n            ))\n        },\n        move |manager, result, ctx| {\n            let (new_state, tx_result) = match result {\n                Ok(credentials) => {\n                    log::info!(\"Bedrock OIDC: credentials loaded successfully\");\n                    (\n                        AwsCredentialsState::Loaded {\n                            credentials,","sourceCodeStart":354,"sourceCodeEnd":390,"githubUrl":"https://github.com/warpdotdev/warp/blob/e72fd7aacbbb2236d9b3be2aad7e7178fe94b4bc/app/src/ai/aws_credentials.rs#L354-L390","documentation":"The AWS SDK STS assume_role_with_webidentity call during Bedrock OIDC credential acquisition failed. The service error's Display string is embedded so details like AccessDenied or InvalidIdentityToken survive to the caller, and the raw SDK error is also reported to Sentry under the context 'Bedrock OIDC: STS AssumeRoleWithWebIdentity SDK error'.","triggerScenarios":"assume_role_with_webidentity() returns a service error: expired or invalid web identity (OIDC) token, role ARN whose trust policy does not allow the OIDC provider, STS throttling, wrong region/endpoint, or network failure reaching STS (aws_credentials.rs:366-375).","commonSituations":"OIDC login is stale and the cached web identity token expired; IAM role trust policy changed after login; STS region mismatch; corporate proxy blocking sts endpoints; AWS throttling during bursts of credential fetches.","solutions":["Re-authenticate Bedrock OIDC to mint a fresh web identity token, then retry","Verify the IAM role's trust policy still allows sts:AssumeRoleWithWebIdentity for the OIDC provider and subject","Check the configured AWS region and that STS is reachable from the network","For throttling (ThrottlingException), add bounded retry with backoff before surfacing the error"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"if let Some(exp) = token.expires_at() {\n    if exp <= SystemTime::now() {\n        reauthenticate_oidc().await?; // don't attempt STS with a stale token\n    }\n}","typeGuard":null,"tryCatchPattern":"match assume_role(&token).await {\n    Err(e) if e.to_string().contains(\"STS AssumeRoleWithWebIdentity failed\") => {\n        if is_invalid_token(&e) { reauthenticate_oidc().await?; } // then retry once\n        with_backoff(|| assume_role(&token)).await\n    }\n    r => r,\n}","preventionTips":["Check web identity token expiry before every STS exchange; re-login proactively","Keep the IAM role trust policy (provider + sts:AssumeRoleWithWebIdentity) in IaC so it cannot drift","Verify STS region configuration and network reachability in new environments"],"tags":["rust","warp","aws","sts","oidc","bedrock","auth"],"backgroundTag":null,"analyzedSha":"e72fd7aacbbb2236d9b3be2aad7e7178fe94b4bc","analyzedAt":"2026-08-16T08:27:25.381Z","schemaVersion":2},"datasetVersion":"2026-08-16T13:17:31.715Z"}