title: Invalid access key error using credentials redeemed from an amazon open id token
body: <p>I'm getting <code>Invalid access key</code> error using credentials redeemed from an amazon open id token from cognito</p>
  
  <p>Here's what I'm doing</p>
  
  <ol>
  <li><p>Get developer authenticated open id token</p>
  
  <p>cognito.getOpenIdTokenForDeveloperIdentity(params, function (err, data)     { </p>
  
  <p>openIdToken = data.credentials
  });</p></li>
  <li><p>Redeem open id token for security credentials, I set the params to the congnito Auth role and set an arbitrary role session name.  I use the token from step 1.  There is no place where I set the identity id from step 1.</p>
  
  <pre><code>it('should be able to exchange temporary open id token for auth credentials', function (done) {
  
      var sts = new AWS.STS();
      var params = {
          RoleArn: roleArn,
          RoleSessionName: 'photo-upload-session',
          WebIdentityToken: openIdToken.Token
      };
      sts.assumeRoleWithWebIdentity(params, function(err, data) {
          should.not.exist(err);
  
          should.exist(data.Credentials.AccessKeyId);
          should.exist(data.Credentials.SecretAccessKey);
          should.exist(data.Credentials.SessionToken);
          credentials = data.Credentials;
  
          done();
      });
  
  
  });
  </code></pre></li>
  <li><p>I update the current credentials</p>
  
  <p><code>AWS.config.update({accessKeyId : credentials.AccessKeyId, secretAccessKey:credentials.SecretAccessKey});</code></p></li>
  <li><p>I upload a file to s3 and get the <code>[InvalidAccessKeyId: The AWS Access Key Id you provided does not exist in our records.]</code> error</p></li>
  </ol>
  
  <p>*edit using Bob Kinney's advice I tried two methods - setting the sessionToken (which worked) and using the Congito credentials which gave a TypeError not a buffer error.  The CognitoIdentityCredentials example is below.</p>
  
  <pre><code>    AWS.config.credentials = new AWS.CognitoIdentityCredentials({
         IdentityPoolId:config.get('aws_identity_pool_id'),
         Logins: {
           'cognito-identity.amazonaws.com': openIdToken.Token
         }
      });
  
      var body = fs.createReadStream(__dirname + '/test_photo.jpg');
  
      var s3obj = new AWS.S3({params: {Bucket: 'test-uploads', Key: 'test'}});
  
      s3obj.upload({Body: body}).
          on('httpUploadProgress', function(evt) { console.log(evt); }).
          send(function(err, data) {
              should.not.exist(err);
              done();
  
          });
  </code></pre>
  
  <p>** update</p>
  
  <p>So moving back to the java client error, we are using the openid token (which was tested to be working correctly with the sts.assumeRoleWithWebIdentity) and passing that token into an extension of AWSAbstractCognitoIdentityProvider (code taken from this link <a href="http://docs.aws.amazon.com/cognito/devguide/identity/developer-authenticated-identities/" rel="nofollow">http://docs.aws.amazon.com/cognito/devguide/identity/developer-authenticated-identities/</a>) - then using that identity to upload to s3 getting the error </p>
  
  <pre><code>CustomAwsIdentityProvider provider = CustomAwsIdentityProvider.newInstance(this, BuildConfig.AWS_COGNITO_POOL_ID, Regions.US_EAST_1);
  
  CognitoCachingCredentialsProvider credentialsProvider = new CognitoCachingCredentialsProvider(this, provider, Regions.US_EAST_1);
  
  TransferManager tm = new TransferManager(credentialsProvider);
  tm.upload("my-upload", uuid.toString(), file);
  </code></pre>