warpdotdev/warp · error

STS AssumeRoleWithWebIdentity failed: {detail}

Error message

STS AssumeRoleWithWebIdentity failed: {detail}

What it means

The AWS SDK STS assume_role_with_webidentity call during Bedrock OIDC credential acquisition failed. The service error's Display string is embedded so details like AccessDenied or InvalidIdentityToken survive to the caller, and the raw SDK error is also reported to Sentry under the context 'Bedrock OIDC: STS AssumeRoleWithWebIdentity SDK error'.

Source

Thrown at app/src/ai/aws_credentials.rs:372

            let session_name = aws_role_session_name(&task_id);
            let credentials = client
                .assume_role_with_web_identity()
                .role_arn(&role_arn)
                .role_session_name(session_name)
                .web_identity_token(token.token)
                .send()
                .await
                .map_err(|err| {
                    // Surface the AWS service error message for a user-friendly error.
                    let detail = err
                        .as_service_error()
                        .map(|e| e.to_string())
                        .unwrap_or_else(|| err.to_string());
                    report_error!(
                        anyhow::Error::new(err)
                            .context("Bedrock OIDC: STS AssumeRoleWithWebIdentity SDK error")
                    );
                    anyhow::anyhow!("STS AssumeRoleWithWebIdentity failed: {detail}")
                })?
                .credentials
                .context("STS response did not include credentials")?;

            anyhow::Ok(AwsCredentials::new(
                credentials.access_key_id().to_string(),
                credentials.secret_access_key().to_string(),
                Some(credentials.session_token().to_string()),
                SystemTime::try_from(*credentials.expiration()).ok(),
            ))
        },
        move |manager, result, ctx| {
            let (new_state, tx_result) = match result {
                Ok(credentials) => {
                    log::info!("Bedrock OIDC: credentials loaded successfully");
                    (
                        AwsCredentialsState::Loaded {
                            credentials,

View on GitHub (pinned to e72fd7aacb)

Solutions

1. Re-authenticate Bedrock OIDC to mint a fresh web identity token, then retry
2. Verify the IAM role's trust policy still allows sts:AssumeRoleWithWebIdentity for the OIDC provider and subject
3. Check the configured AWS region and that STS is reachable from the network
4. For throttling (ThrottlingException), add bounded retry with backoff before surfacing the error

if let Some(exp) = token.expires_at() {
    if exp <= SystemTime::now() {
        reauthenticate_oidc().await?; // don't attempt STS with a stale token
    }
}

match assume_role(&token).await {
    Err(e) if e.to_string().contains("STS AssumeRoleWithWebIdentity failed") => {
        if is_invalid_token(&e) { reauthenticate_oidc().await?; } // then retry once
        with_backoff(|| assume_role(&token)).await
    }
    r => r,
}

When it happens

Trigger: assume_role_with_webidentity() returns a service error: expired or invalid web identity (OIDC) token, role ARN whose trust policy does not allow the OIDC provider, STS throttling, wrong region/endpoint, or network failure reaching STS (aws_credentials.rs:366-375).

Common situations: OIDC login is stale and the cached web identity token expired; IAM role trust policy changed after login; STS region mismatch; corporate proxy blocking sts endpoints; AWS throttling during bursts of credential fetches.

Related errors

• STS AssumeRoleWithWebIdentity failed: {detail}
• Expected {} field values, got {}
• Field '{}' is required
• Auth secret type {:?} is not supported via the harness FTUX
• Failed to fetch images

AI-assisted analysis of warpdotdev/warp@e72fd7aacb (2026-08-16). Data as JSON: /api/errors/88de574155b14a2a. Report an issue: GitHub.