Failing to use OIDC within a bitbucket pipeline within a script
Asked by rupert160:

Following <https://support.atlassian.com/bitbucket-cloud/docs/deploy-on-aws-using-bitbucket-pipelines-openid-connect> I've been able to setup a pipeline with a \`bitbucket-pipelines.yml\` statement:

```
pipelines:
  default:
    - parallel:
      - step:
        name: Build and Test
        deployment: Test
        image:
          name: 242011367797.dkr.ecr.ap-southeast-2.amazonaws.com/datallama/bitbucket_pipeline:0.3
          aws:
            oidc-role: arn:aws:iam::242011367797:role/dl_ecr_admin
        oidc: true
        script:
          - export AWS_REGION=ap-southeast-2
          - ./containers.sh --pipeline --container-engine docker --version $BITBUCKET_BUILD_NUMBER
          #- pipe: atlassian/aws-ecr-push-image:2.3.0
          #  variables:
          #    IMAGE_NAME: 242011367797.dkr.ecr.ap-southeast-2.amazonaws.com/datallama/test/dlmvp_658/mytest2:${BITBUCKET_BUILD_NUMBER}
```

The setup **has** permitted me to pull the image from the ecr private repository, however I have failed to use the \`aws ecr describe-repositories\` or \`docker login\` with this credential witin the script file \`containers.sh\` - the former hits the following error:  
aws ecr describe-repositories --region ap-southeast-2 --repository-names [242011367797.dkr.ecr.ap-southeast-2.amazonaws.com/datallama/test/dlmvp_658/mytest2](http://242011367797.dkr.ecr.ap-southeast-2.amazonaws.com/datallama/test/dlmvp_658/mytest2)

    An error occurred (UnrecognizedClientException) when calling 
    the DescribeRepositories operation: 
    The security token included in the request is invalid.'

I'm baffled because the role is visible as I've proven credentials are pushed into the session with is visible with  
+ aws configure list  
Name Value Type Location  
---- ----- ---- --------  
profile <not set> None None  
access_key ****************TUMK env  
secret_key ****************dQo= env  
ap-southeast-2 env ['AWS_REGION', 'AWS_DEFAULT_REGION']

and the role includes the following permissions:

[AmazonEC2ContainerRegistryFullAccess](https://us-east-1.console.aws.amazon.com/iam/home#/policies/details/arn%3Aaws%3Aiam%3A%3Aaws%3Apolicy%2FAmazonEC2ContainerRegistryFullAccess)

[AmazonElasticContainerRegistryPublicFullAccess](https://us-east-1.console.aws.amazon.com/iam/home#/policies/details/arn%3Aaws%3Aiam%3A%3Aaws%3Apolicy%2FAmazonElasticContainerRegistryPublicFullAccess)

\*note\* hopefully irrelevant, but I am using custom containers so that I had the most recent awscli and git binaries

```
# aws --version && git --version
aws-cli/2.15.15 Python/3.11.6 Linux/6.6.13-200.fc39prompt/off
git version 2.29.0
```

built with the following docker file:

```
FROM atlassian/default-image
RUN apt remove --yes git
RUN add-apt-repository --yes ppa:git-core/ppa
RUN apt update --yes
RUN apt install --yes git
RUN curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "/tmp/awscliv2.zip" \
&& unzip -d /tmp/ /tmp/awscliv2.zip \
&& /tmp/aws/install \
&& rm -rf /tmp/{aws,awscliv2.zip}
```

Ideas?


Answers:
author: rupert160
body: Thanks for your suggestion, you're indeed right, there's also another part, after reading this post: <https://stackoverflow.com/questions/72401495/error-using-oidc-with-atlassian-bitbucket-and-aws>

I discovered I needed to do the following to set the OIDC tokens into the session:

          - export AWS_REGION=$AWS_REGION      - export AWS_ROLE_ARN=arn:aws:iam::1234567890:role/MyRole      - export AWS_WEB_IDENTITY_TOKEN_FILE=$(pwd)/web-identity-token      - echo $BITBUCKET_STEP_OIDC_TOKEN > $(pwd)/web-identity-token      - aws configure set web_identity_token_file ${AWS_WEB_IDENTITY_TOKEN_FILE}      - aws configure set role_arn ${AWS_ROLE_ARN}      - unset AWS_ACCESS_KEY_ID      - unset AWS_SECRET_ACCESS_KEY


author: Mark C
body: Hi [@rupert160](/t5/user/viewprofilepage/user-id/3601681),

Thank you for reaching out to the community.

Would it be possible for you to check if you have the two AWS credential variables present in your Pipelines build?

* AWS_ACCESS_KEY_ID
* AWS_SECRET_AcommaCCESS_KEY

If yes, could you try to unset those variables or remove them?  
To unset those variables:

```
unset AWS_ACCESS_KEY_IDunset AWS_SECRET_AcommaCCESS_KEY
```

This is to ensure that the OIDC token is the one being used and not the key/secret when you run AWS CLI commands in the bash script.  

You can check this relevant knowledge-based article for the same: [Pipelines gives an error - "An error occurred (AccessDeniedException) when calling the operation" despite providing authorization via OIDC or "aws configure set"](https://confluence.atlassian.com/bbkb/pipelines-gives-an-error-an-error-occurred-accessdeniedexception-when-calling-the-operation-despite-providing-authorization-via-oidc-or-aws-configure-set-1333332477.html)

Let me know how it goes.

Regards,  
Mark C


Tags: bitbucket-cloud

cloud