How to Fix AWS Federation Issues

If you’re having trouble establishing federation to AWS using your OIDC provider, here’s a straightforward approach to troubleshoot and resolve the issue:

First, ensure you’ve correctly set up the identity provider in AWS. You’ve already created an identity provider with the URL iamcredentials.apis-tpczero.goog and linked it to the correct email, like cloud-pubsub-team@cloud-pubsub-prober.tpczero-system.iam.gserviceaccount.com. That’s a good start.

Next, check the trust relationship in the IAM role. It should specify the correct OIDC provider ARN and set the proper condition. For example, the trust policy should look similar to this:

{
“Version”: “2012-10-17”,
“Statement”: [
{
“Effect”: “Allow”,
“Principal”: {
“Federated”: “arn:aws:iam::YOUR_ACCOUNT_ID:oidc-provider/iamcredentials.apis-tpczero.goog”
},
“Action”: “sts:AssumeRoleWithWebIdentity”,
“Condition”: {
“StringEquals”: {
“iamcredentials.apis-tpczero.goog:aud”: “cloud-pubsub-team@cloud-pubsub-prober.tpczero-system.iam.gserviceaccount.com”
}
}
}
]
}

Important: Make sure you’re using the correct claim in the condition. Some try to use oaud instead of aud. Usually, the aud claim is the right one to match the audience, especially if your token includes aud with that value.

After that, when calling AWS STS with the web token, ensure your token payload is valid and includes the correct aud claim matching your trust policy. Your token payload should have an aud field like:

json
{
“aud”: “cloud-pubsub-team@cloud-pubsub-prober.tpczero-system.iam.gserviceaccount.com”,
“iss”: “https://iamcredentials.apis-tpczero.goog“,
“sub”: “102661651780308334564”,
“email”: “cloud-pubsub-team@cloud-pubsub-prober.tpczero-system.iam.gserviceaccount.com”,
“iat”: 1787085463,
“exp”: 1787089063
}

Key Point: Make sure the token is correctly signed and issued by the expected provider, and that the token is valid (not expired).

If you continue to see the error InvalidIdentityToken, it may be caused by:

• The token not matching the claim specified in the trust policy (aud).
• The token being malformed or invalid.
• The trust relationship not correctly configured, especially the claim condition.

Next steps to fix this:

1. Double-check the trust policy’s StringEquals condition — it should target the aud claim, not oaud unless your token specifically has oaud.
2. Verify that the token you generate includes the aud claim matching what you’ve specified.
3. Confirm your token is properly signed and issued by the Google OIDC provider.
4. Use tools or online JWT inspectors to verify the token’s payload and signature.

Following these steps carefully should help identify and correct the root cause. If issues persist, re-execute the setup from scratch, ensuring all claims and policies are aligned and correctly configured.