Struggling to get SSO working with v2 of the Go SDK

[robwilkerson]

I've authenticated using aws sso login --profile my-profile. I've also verified that I can run aws sts get-caller-identity. All good. Now I want to run a small go command line utility that does the same thing, but I'm getting invalid token errors. I'm following the code samples I've seen, but still getting errors.

func whoAmI() {
        ctx := context.TODO()

        fmt.Printf("AWS profile: '%s'\n", os.Getenv("AWS_PROFILE")) // shows the name of the profile under which i'm currently authenticated just for reference

        cfg, err := config.LoadDefaultConfig(
            ctx,
            config.WithSharedConfigProfile("same-profle-name-as-above"),
        )
        if err != nil {
            log.Fatal(err)
        }

        fmt.Printf("%+v\n", cfg) // shows me all the right stuff (keys, region, etc.)

        client := sts.NewFromConfig(cfg)
        identity, err := client.GetCallerIdentity(
            ctx,
            &sts.GetCallerIdentityInput{},
        )
        if err != nil {
            log.Fatal(err)
            // operation error STS: GetCallerIdentity, https response error StatusCode: 403, RequestID: <UUID>, api error InvalidClientTokenId: The security token included in the request is invalid
        }

        fmt.Printf("%+v", identity)

        return nil
}

I'd really appreciate any help I can get. The suggestions I've seen thus far might have a v1 focus because they reference functions that don't exist in modules or don't seem to align with the documentation I've read.

[jmklix]

Here is how to use sso credentials with this sdk:

import "github.com/aws/aws-sdk-go-v2/config"

// ...

cfg, err := config.LoadDefaultConfig(
	context.Background(),
	config.WithSharedConfigProfile("dev-profile"),
)
if err != nil {
	return err
}

This is basically what you already have, so I would make sure that you have authenticated correctly. You can find the full detailed explanation here. Please let us know if you have any more questions about how to do this.

[hjkatz]

The error still persists even when using the code you provided. Specifically try the following to reproduce:

// retrieve the config
cfg, err := config.LoadDefaultConfig(
	context.Background(),
	config.WithSharedConfigProfile("dev-profile"),
)
if err != nil {
	return err
}

client := sts.NewFromConfig(cfg)

// test the config
_, err := client.GetCallerIdentity(context.Background(), &sts.GetCallerIdentityInput{})
if err != nil {
  // err will not _always_ be nil
  fmt.Fprintf(os.Stderr, "DEBUGPRINT[1]: main.go:102: err=%+v\n", err)
}

Prints:

DEBUGPRINT[1]: main.go:102: err=operation error STS: GetCallerIdentity, https response error StatusCode: 403, RequestID: 6c641e62-6713-4b8f-99cf-8d0540edc5fd, api error InvalidClientTokenId: The security token included in the request is invalid

Also be sure to run this a few times -- the error is every-so-often ~20% of the time.

[hjkatz]

FWIW a single retry seems to solve this problem, example code:

client := sts.NewFromConfig(cfg)

attempt := 0
retries := 3
delay := 100 * time.Millisecond

for attempt < retries {
  attempt++

  _, err := client.GetCallerIdentity(...)
  if err == nil {
    // success
    return nil
  }

  if !strings.Contains(err.Error(), "api error InvalidClientTokenId") {
    // non-retryable error
    return err
  }

  // error, backoff and try again
  time.Sleep(delay)
}

return nil

[spy16x]

One thing that worked for me is to clear the ~/.aws/credentials file. It seems that it is picking the the key and secret from that file if it's present. I also confirmed this by taking the new key & secret from the AWS Access Portal and updating the file and then running my code -- In this case also, the SDK worked. But it stops working after the SSO session expires.