kopia/kopia · error

getting web identity credentials

Error message

getting web identity credentials

What it means

Thrown by newStorage when constructing an STS web-identity credential provider (credentials.NewSTSWebIdentity) fails, e.g. malformed options or the minio credentials package cannot initialize the fetcher. It wraps the underlying error from the credentials package.

Solutions

1. Verify WebIdentityTokenFile points to a readable file or WebIdentityToken is non-empty
2. Check RoleARN format (arn:aws:iam::<account>:role/<name>) and RoleSessionName
3. Confirm STS endpoint (opt.RoleEndpoint) is reachable and correct region
4. Fall back to the default credential chain if web identity is not needed

Example fix

// before
opt := s3.Options{WebIdentityTokenFile: "/var/run/secrets/tokens/missing.token", RoleARN: "arn:aws:iam::123:role/r"}
// after
opt := s3.Options{WebIdentityTokenFile: "/var/run/secrets/eks.amazonaws.com/serviceaccount/token", RoleARN: "arn:aws:iam::123:role/r"}

if opt.WebIdentityToken == "" && (opt.WebIdentityTokenFile == "" ) { return errors.New("web identity token or token file required") }
if !strings.HasPrefix(opt.RoleARN, "arn:aws:iam::") { return errors.New("invalid RoleARN") }

store, err := s3.New(ctx, &opt)
if err != nil && strings.Contains(err.Error(), "getting web identity credentials") {
    // fall back to default credential chain or surface config guidance
}

When it happens

Trigger: Calling New with a WebIdentityTokenFile or WebIdentityToken configured (EKS/IRSA style) and the STSWebIdentity provider construction returns an error — typically a bad role session name, invalid token file reference, or unavailable STS endpoint at construction time.

Common situations: EKS service accounts with IRSA misconfigured; token file path wrong; minio-go version incompatibility with the STS credential API.

Related errors

• getting assume role credentials
• reading web identity token file
• Access denied.
• could not get versioning info for
• could not list blob versions at time

AI-assisted analysis of kopia/kopia@82495e54b5 (2026-09-07). Data as JSON: /api/errors/ecf8216ddbcbec2c. Report an issue: GitHub.

Appendix: source

Thrown at repo/blob/s3/s3_storage.go:378

					Transport: http.DefaultTransport,
				},
			},
		},
	)

	hasWebIdentity := opt.WebIdentityToken != "" || opt.WebIdentityTokenFile != ""
	if opt.RoleARN != "" && hasWebIdentity {
		var err error

		creds, err = credentials.NewSTSWebIdentity(
			opt.RoleEndpoint,
			webIdentityTokenFetcher(opt),
			func(i *credentials.STSWebIdentity) {
				i.RoleARN = opt.RoleARN
			},
		)
		if err != nil {
			return nil, errors.Wrap(err, "getting web identity credentials")
		}
	}

	// If a role was specified, use the assume role credential provider
	if opt.RoleARN != "" && !hasWebIdentity {
		assumeRoleOpts := credentials.STSAssumeRoleOptions{
			AccessKey:       opt.AccessKeyID,
			SecretKey:       opt.SecretAccessKey,
			RoleSessionName: opt.SessionName,
			SessionToken:    opt.SessionToken,
			RoleARN:         opt.RoleARN,
			DurationSeconds: int(opt.RoleDuration.Seconds()),
			Location:        opt.RoleRegion,
		}

		var err error

		creds, err = credentials.NewSTSAssumeRole(

View on GitHub (pinned to 82495e54b5)