{"record":{"id":"ecf8216ddbcbec2c","repo":"kopia/kopia","slug":"getting-web-identity-credentials","errorCode":null,"errorMessage":"getting web identity credentials","messagePattern":"getting web identity credentials","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"repo/blob/s3/s3_storage.go","lineNumber":378,"sourceCode":"\t\t\t\t\tTransport: http.DefaultTransport,\n\t\t\t\t},\n\t\t\t},\n\t\t},\n\t)\n\n\thasWebIdentity := opt.WebIdentityToken != \"\" || opt.WebIdentityTokenFile != \"\"\n\tif opt.RoleARN != \"\" && hasWebIdentity {\n\t\tvar err error\n\n\t\tcreds, err = credentials.NewSTSWebIdentity(\n\t\t\topt.RoleEndpoint,\n\t\t\twebIdentityTokenFetcher(opt),\n\t\t\tfunc(i *credentials.STSWebIdentity) {\n\t\t\t\ti.RoleARN = opt.RoleARN\n\t\t\t},\n\t\t)\n\t\tif err != nil {\n\t\t\treturn nil, errors.Wrap(err, \"getting web identity credentials\")\n\t\t}\n\t}\n\n\t// If a role was specified, use the assume role credential provider\n\tif opt.RoleARN != \"\" && !hasWebIdentity {\n\t\tassumeRoleOpts := credentials.STSAssumeRoleOptions{\n\t\t\tAccessKey:       opt.AccessKeyID,\n\t\t\tSecretKey:       opt.SecretAccessKey,\n\t\t\tRoleSessionName: opt.SessionName,\n\t\t\tSessionToken:    opt.SessionToken,\n\t\t\tRoleARN:         opt.RoleARN,\n\t\t\tDurationSeconds: int(opt.RoleDuration.Seconds()),\n\t\t\tLocation:        opt.RoleRegion,\n\t\t}\n\n\t\tvar err error\n\n\t\tcreds, err = credentials.NewSTSAssumeRole(","sourceCodeStart":360,"sourceCodeEnd":396,"githubUrl":"https://github.com/kopia/kopia/blob/82495e54b584c1ef6073c9e1be048f57f8aef078/repo/blob/s3/s3_storage.go#L360-L396","documentation":"Thrown by newStorage when constructing an STS web-identity credential provider (credentials.NewSTSWebIdentity) fails, e.g. malformed options or the minio credentials package cannot initialize the fetcher. It wraps the underlying error from the credentials package.","triggerScenarios":"Calling New with a WebIdentityTokenFile or WebIdentityToken configured (EKS/IRSA style) and the STSWebIdentity provider construction returns an error — typically a bad role session name, invalid token file reference, or unavailable STS endpoint at construction time.","commonSituations":"EKS service accounts with IRSA misconfigured; token file path wrong; minio-go version incompatibility with the STS credential API.","solutions":["Verify WebIdentityTokenFile points to a readable file or WebIdentityToken is non-empty","Check RoleARN format (arn:aws:iam::<account>:role/<name>) and RoleSessionName","Confirm STS endpoint (opt.RoleEndpoint) is reachable and correct region","Fall back to the default credential chain if web identity is not needed"],"exampleFix":"// before\nopt := s3.Options{WebIdentityTokenFile: \"/var/run/secrets/tokens/missing.token\", RoleARN: \"arn:aws:iam::123:role/r\"}\n// after\nopt := s3.Options{WebIdentityTokenFile: \"/var/run/secrets/eks.amazonaws.com/serviceaccount/token\", RoleARN: \"arn:aws:iam::123:role/r\"}","handlingStrategy":"try-catch","validationCode":"if opt.WebIdentityToken == \"\" && (opt.WebIdentityTokenFile == \"\" ) { return errors.New(\"web identity token or token file required\") }\nif !strings.HasPrefix(opt.RoleARN, \"arn:aws:iam::\") { return errors.New(\"invalid RoleARN\") }","typeGuard":null,"tryCatchPattern":"store, err := s3.New(ctx, &opt)\nif err != nil && strings.Contains(err.Error(), \"getting web identity credentials\") {\n    // fall back to default credential chain or surface config guidance\n}","preventionTips":["Verify the token file path exists before calling New","Validate RoleARN format in config loading","Test IRSA setup with aws sts get-caller-identity inside the pod","Pin minio-go versions known to work with your STS setup"],"tags":["aws","sts","web-identity","credentials"],"backgroundTag":"oauth-token-exchange-failed","analyzedSha":"82495e54b584c1ef6073c9e1be048f57f8aef078","analyzedAt":"2026-09-07T20:35:21.689Z","contentChangedAt":"2026-09-07T20:35:21.689Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}