GetResourceOauth2Token returns ValidationException: Error parsing ClientCredentials response

[CermakM]

When calling the following CLI command:

 aws bedrock-agentcore get-resource-oauth2-token --workload-identity-token <workloadaccesstoken> --resource-credential-provider-name 'tradeforge-m2m' --scopes "email" --oauth2-flow 'M2M'

I receive An error occurred (ValidationException) when calling the GetResourceOauth2Token operation: Error parsing ClientCredentials response

I have absolutely no way to debug this. The same happens during runtime when using the SDK and there is no way to get to the actual reason as for why this is happening (what exactly was returned by the identity provider).

I'd greatly appreciate some degree of insight into the responses so that I could debug if the issue is on my side or not.

[brianlaoaws]

Thank you for raising this issue and bringing it to our attention. We don't propagate errors from the resource credential provider. This is something I will discuss with the team to see if we can have a better mechanism for communicating errors from the provider.

In the meantime, can you share which region you are you experiencing this in? Can you also:

1. Call GetOauth2CredentialProvider on the tradeforge-m2m provider and double check the configuration
2. Can you try recreating the credential provider and using the newly created one?

[azaylamba]

I am also facing the same issue. The AWS region is us-east-1 and I am using Cognito as the credentials provider with client credentials flow.

I am trying to get the access token using requires_access_token decorator. During debugging, I found that workloadIdentityToken is successfully retrieved but the error is thrown while getting the OAuth2 access token. Couldn't find out the actual root cause but the status code is 400 and reason is Bad Request.

[azaylamba]

In my case, the cognito URL was incorrect, seems to be working fine now after correcting the url.