Aws-iam-authenticator: Receiving 403 error on call to STS

[wbauern]

I have successfully installed the authenticator in one of our clusters. Following the same steps I installed it in another cluster but I can't seem to get it to work correctly. For every auth attempt I am receiving the following error message in the authenticator pod logs:

{"log":"time="2018-08-08T16:41:30Z" level=warning msg="access denied" client="127.0.0.1:27688" error="sts getCallerIdentity failed: error from AWS (expected 200, got 403)" method=POST path=/authenticaten","stream":"stderr","time":"2018-08-08T16:41:30.131521462Z"}

I'm able to successfully generate a token from the cli and when I run verify on it everything looks correct.

I've tried hitting the STS URL contained in the token directly but I get a SignatureDoesNotMatch error back. I don't think this is a valid test though since I get the same error when I try this with a token from my working cluster.

Any tips on how to debug this type of problem?

Thanks,
Bill

[wbauern]

Ended up figuring out the issue.

[ursuad]

@wbauern Do you know what the issue was? I'm facing the exact problem, and I can't seem to figure out what I'm doing wrong.

[ursuad]

Ok, I figured what the issue was, I was using the wrong ClusterID in the configmap. Leaving this here, just in case someone else has the same problem.

[fred-vogt]

If anyone winds up here.

The value used for clusterID must be the same when a token created / verified.
The clusterID is used as the value for a custom header x-k8s-aws-id for AWS v4 request signing.

The server logs in v0.5+ now show the AWS error message:

error="sts getCallerIdentity failed: error from AWS (expected 200, got 403)
Body: {
  "Error": {
    "Code": "SignatureDoesNotMatch",
    "Message": "
      The request signature we calculated does not match the signature you provided. 
      Check your AWS Secret Access Key and signing method. 
      Consult the service documentation for details.",
    "Type": "Sender"},
  "RequestId": "<guid>"
}
method=POST

You can verify this using the authenticator CLI:

export CLUSTER_ID=...

aws-iam-authenticator verify -i "$CLUSTER_ID" -t \
  $(AWS_PROFILE=... aws-iam-authenticator token -i "$CLUSTER_ID" | jq -r '.status.token')