Closed rgare-travistrue closed 1 month ago
Hi @rgare-travistrue - thanks for reaching out and sorry for the inconvenience.
I tried replacing AWS.CognitoIdentityCredentials() with fromCognitoIdentityPool(), but got a 403 Access Denied error from S3's API when I used it because there's no way to provide a RoleArn like we can do with the old AWS.CognitoIdentityCredentials().
Regarding the issue with the credential provider: You mentioned that you tried replacing AWS.CognitoIdentityCredentials()
with fromCognitoIdentityPool()
, but encountered a 403 Access Denied error from the S3 API when using it. The reason for this error is that there is no way to provide a RoleArn
with fromCognitoIdentityPool(), which was possible with the old AWS.CognitoIdentityCredentials()
.
To resolve this, you should be able to use the customRoleArn
option when calling fromCognitoIdentityPool() to provide the required RoleArn
.
Concerning the second issue: You seem to be directly passing STS credentials to the SDK, which returns credentials in camel case format. However, the SDK expects the credentials to be in lower case format. This mismatch in casing is the expected behavior when passing STS credentials directly to the SDK.
return new S3Client({
region,
credentials: {
accessKeyId: Credentials.AccessKeyId,
secretAccessKey: Credentials.SecretAccessKey,
sessionToken: Credentials.SessionToken,
expiration: Credentials.Expiration
}
})
Best, John
Hey John, thanks for the reply. I also tried passing the ARN as the customRoleArn
property in fromCognitoIdentityPool()
, but then I got an error stating something about Cognito missing ARN pairs or something similar to that. I'm not too familiar with Cognito, but it seems like upgrading to v3 requires us to do some additional configuration with our Cognito user pool.
Anyway, this workaround seemed to do the trick for now. Our team was going to replace the AWS SDK with Amplify anyway, so the overall goal was to get a quick fix in for now since we're going to swap out the AWS SDK in the next few months anyway.
This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs and link to relevant comments in this thread.
Pre-Migration Checklist
UPGRADING.md
.Which JavaScript Runtime is this issue in?
Browser
AWS Lambda Usage
Describe the Migration Issue
I'm running into an issue with updating Cognito authorization, so that our React app can upload objects directly to S3. I attempted to translate the call to AWS.CognitoIdentityCredentials() to a set of v3 calls.
Code Comparison
Here's the working v2 snippet:
Here's the working v3 snippet:
Observed Differences/Errors
I tried replacing
AWS.CognitoIdentityCredentials()
with fromCognitoIdentityPool(), but got a 403 Access Denied error from S3's API when I used it because there's no way to provide aRoleArn
like we can do with the oldAWS.CognitoIdentityCredentials()
.I old
AWS.CognitoIdentityCredentials()
appears to be a wrapper function around multiple Cognito calls, depending on the parameters that are provided. I ended up calling the v3-equivalent calls that make upAWS.CognitoIdentityCredentials()
to replicate theRoleArn
using the STS Client'sAssumeRoleWithWebIdentityCommand()
, but now I get this error:Additional Context
Here's the shape of the
Credentials
object that I get back from my call toAssumeRoleWithWebIdentityCommand()
:I looked at the source code for the error, and it's because all of the property names in
Credentials
are inPascalCase
and notcamelCase
. TheS3Client
constructor is expecting credentials withcamelCase
property names. Rebuilding a new object with the expected-named property names seemed to have solved my problem: