OIDC not working with aws-cli but works with pipes

Deb Mohan

I am trying to use OIDC with a role and a web identity on aws. I followed the steps from https://support.atlassian.com/bitbucket-cloud/docs/deploy-on-aws-using-bitbucket-pipelines-openid-connect/

As noted at the end of the post, the OIDC works when I use atlassian pipes but it does not work with the export and aws cli options.

# bitbucket pipeline - this one fails
image: amazon/aws-cli
pipelines:
default:
 - step:
name: Connect to AWS using OIDC
oidc: true
script:
 - unset AWS_SECRET_ACCESS_KEY
 - unset AWS_ACCESS_KEY_ID
 - export AWS_REGION=$AWS_REGION
 - export AWS_ROLE_ARN=arn:aws:iam::1234567890:role/MyRole
 - export AWS_WEB_IDENTITY_TOKEN_FILE=$(pwd)/web-identity-token
 - echo $BITBUCKET_STEP_OIDC_TOKEN > $(pwd)/web-identity-token
 - printenv BITBUCKET_STEP_OIDC_TOKEN
 - printenv AWS_REGION
 - printenv AWS_ROLE_ARN
 - aws sts assume-role-with-web-identity --role-arn arn:aws:iam::1234567890:role/MyRole --role-session-name build-session --web-identity-token "$BITBUCKET_STEP_OIDC_TOKEN" --duration-seconds 1000
 - aws sts get-caller-identity

# Output from the above:

printenv AWS_REGION
us-east-2

printenv AWS_ROLE_ARN
arn:aws:iam::1234567890:role/MyRole

printenv BITBUCKET_STEP_OIDC_TOKEN
<nothing here>

# Error:

An error occurred (AccessDenied) when calling the AssumeRoleWithWebIdentity operation: Not authorized to perform sts:AssumeRoleWithWebIdentity

# this one works with the same AccessIdentityRole to copy files from my build to the s3 bucket

- pipe: atlassian/aws-s3-deploy:1.1.0
  variables:
    AWS_DEFAULT_REGION: $AWS_REGION # Optional if already defined in the context or OIDC used.
    AWS_OIDC_ROLE_ARN: $AWS_OIDC_ROLE_ARN # Optional by default. Required for OpenID Connect (OIDC) authentication.
    S3_BUCKET: mygreat-bucket
    LOCAL_PATH: 'build'
    CACHE_CONTROL: 'max-age=86400'

# Role Policy:
 {
   "Version": "2012-10-17",
   "Statement": [
     {
       "Effect": "Allow",
       "Action": "*",
       "Resource": "*"
     }

   ]
 }

# Trust Relationship:

 {
   "Version": "2012-10-17",
   "Statement": [
     {
       "Effect": "Allow",
       "Principal": {
          "Federated": "arn:aws:iam::1234567890:oidc-provider/api.bitbucket.org/2.0/workspaces/myworkspace/pipelines-config/identity/oidc"
        },
        "Action": "sts:AssumeRoleWithWebIdentity",
        "Condition": {
        "StringEquals": {
          "api.bitbucket.org/2.0/workspaces/myworkspace/pipelines-config/identity/oidc:sub": "w234y098-f0tk-823a-45m1-qwrth8912n00:*"
         }
       }
     }
   ]
 }

Patrik S

Hello @Deb Mohan ,

Thank you for reaching out to Atlassian Support.

From the error message, you are receiving it seems the policy/trust relationship you are currently using is not allowing the pipeline's environment to assume the role :

Accordingly to the trust relationship you have shared, it seems you have configured it to allow only the repository with the UUID below to assume the role :

w234y098-f0tk-823a-45m1-qwrth8912n00

Checking for that UUID internally I was not able to find it associated with any repository. Could you please double-check if the value is correct? You can do that by following the below steps : 

• Access the repository where the pipeline runs
• Go to Repository Settings
• Click on OpenID Connect under Pipelines
• Copy the content of the field Repository UUID
• Paste it in your trust relationship rule, including the braces {}, as below : 

  "StringEquals": {
            "api.bitbucket.org/2.0/workspaces/myworkspace/pipelines-config/identity/oidc:sub": "{REPOSITORY_UUID}:*"

  You can also refer to the following document for instructions on how you can add conditions to your trust relationship in AWS : 
  https://support.atlassian.com/bitbucket-cloud/docs/deploy-on-aws-using-bitbucket-pipelines-openid-connect/#Allowing-only-a-specific-repository-to-assume-the-role

If that does not work, you can also try to remove the trust relationship condition temporarily and test running your build again to check if the command you are executing is able to assume the role.

Hope that helps, let me know in case you have any questions!

Thank you, @Deb Mohan .

Kind regards,

Patrik S