This repository was archived by the owner on May 12, 2026. It is now read-only.
Repository navigation
This repository was archived by the owner on May 12, 2026. It is now read-only.
AWS_SESSION_TOKEN not resolved from environment #723
Description
AWS Lambda and other AWS services are using an assumed IAM Role with temporary security credentials and therefore It is not possible to create a valid subject token to be exchanged with sts.googleapis.com.
In AWSCredentials the following code exists:
@VisibleForTesting
AwsSecurityCredentials getAwsSecurityCredentials() throws IOException {
// Check environment variables for credentials first.
String accessKeyId = getEnvironmentProvider().getEnv("AWS_ACCESS_KEY_ID");
String secretAccessKey = getEnvironmentProvider().getEnv("AWS_SECRET_ACCESS_KEY");
String token = getEnvironmentProvider().getEnv("Token");
if (accessKeyId != null && secretAccessKey != null) {
return new AwsSecurityCredentials(accessKeyId, secretAccessKey, token);
}
...
The environment variable for the session token in an AWS environment is named "AWS_SESSION_TOKEN" and not "Token".
String token = getEnvironmentProvider().getEnv("AWS_SESSION_TOKEN");
Refer to Python library google-auth-library-python where the processing of temporary security credentials is correctly implemented.
Kind regards,
Oliver
Originally posted by @oprigan-cgi in #714 (comment)
Activity
TimurSadykov commentedon Oct 27, 2021
@oprigan-cgi this should be fixed in 1.2.2 See related PR
oprigan-cgi commentedon Nov 3, 2021
Thank you very much.