Github actions: OpenIDConnect provider's HTTPS certificate doesn't match configured thumbprint - amazon-web-services

I'm currently working on a code that is placed on GitHub, and when we run the GitHub actions after pulling requests, we are receiving the following error because we have this deployment on AWS :enter image description here This error is recent, it didn't pop up until this Tuesday.
enter image description here
I've trying some things, like this information on this post from January: https://github.blog/changelog/2022-01-13-github-actions-update-on-oidc-based-deployments-to-aws/ But it didn't work, and one of my partners tried this other post https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc_verify-thumbprint.html. but with no success. I don't know if this thumbprint got updated again recently, if anyone have any suggestion, I'm happy to receive them. Even if there is any shareable information that I can provide

We had the same issue recently with our aws stack deployed with AWS CDK and GitHub Actions. In our case updating the CDK version and redeploying solved the problem.

Related

AWS Exception "The If-Match version is missing or not valid for the resource" when updating using web interface

When updating my AWS Cloudfront distribution using the AWS web interface, I get the following error: "The If-Match version is missing or not valid for the resource.".
I cannot disable, delete, update or do any actions on the distribution to my knowledge.
There's similar questions on StackOverflow, but they deal with the AWS console.
Have I done something, or have AWS miss-used their own API?
It was caused by the ClearURLs plugin I had installed in Chrome.
https://repost.aws/questions/QUdbuTO7zDRkWBHhQ6K7tDqA/cant-edit-the-if-match-version-is-missing-or-not-valid-for-the-resource

API Gateway Error : Site can't be reached

I followed the process from this video : here
I created the Lambda function, and the API, and when I am testing in the API Gateway editor, it is working properly. Giving status 200 and correct output.
Here when I deployed I gave the url + /opencv as said in the video, but the browser doesn't give any output and gave the result site not reachable.
I also tried without the resource /opencv and when I run the url which I get after deployment I get {"message":"Missing Authentication Token"} error.
So, how am I able to get the output while testing in the AWS tool as shown in the picture above but after deployment I am not able to get. What am I missing?
Check Your Stages under Resources and verify the URL and try to create a new stage. i just followed the same steps and i can see it is working fine. In order to reproduce, i deleted the Stage and verified it gives me the error which you have mentioned. So try to reproduce the steps again by creating a new stage under resources as it will enable you to have auto new URL and then verify. Incase if it does not work, do share your stage Screenshot next time.
For others that get the same issue. One solution is to wait a bit:
I also had this error when first time deploying the API GW. It then started working fine ~5-10min later.

serverless express/jade website on AWS

I am new to serverless, and try to build a simple express website on AWS with lambda and api gateway.
The site runs successfully on my local, but after deploying to AWS, there is a issue about jade route as AWS gives a stage name to deployed API, for example: the root(/) url is something like - https://opl3cla000.execute-api.ap-southeast-2.amazonaws.com/prod(the prod is stage name). While in my jade layout.jade, I have code like
ul.nav.navbar-nav
li
a(href="/page1") Page1
li
a(href="/page2") Page2
My jade code does not include the stage name, so it gives 403 as the path is https://opl3cla000.execute-api.ap-southeast-2.amazonaws.com/prod/page1 instead of https://opl3cla000.execute-api.ap-southeast-2.amazonaws.com/page1.
I am not sure if it is the correct configuration, and how can I fix it?
I use the middleware from awslabs/aws-serverless-express and get the answer from the author.
The reference link is below:
https://github.com/awslabs/aws-serverless-express/issues/11

AWS API Gateway won't open up

I created a "hello world" lambda function and then deployed it to an end-point using AWS's API Gateway:
All very much basic settings but I was sure to change the security to "open" and while i was told that it could take up for 15 minutes for the domain to resolve I found that even after 30 I was getting the following response from the "open" end-point:
{"message":"Missing Authentication Token"}
Am I missing something obvious? Shouldn't this have been available with what I did?
Note, it was pointed out that this image is of a PUT not a GET. I tried both and both came back errors. Just to check I've run GET and PUT through Postman and get a similar but not identical response:
and then GET ...
When I test the lambda function in the console it runs successfully but running it in the API Gateway it gives me a different articulation of the same error:
Tue Sep 29 20:57:43 UTC 2015 : Execution failed due to configuration error: Invalid permissions on Lambda function
and yet I used the default permissions that the console suggested. The lambda function itself is very basic and can be found here: code
I was having the exact some problem today. Whatever I did didn't work but finally figured out. turns out in order for the changes to take effect, you need to Deploy API.
So first go to Resources and click on Deploy API button. It will ask for a deployment stage. Once deployed I could call my API without any issues.
I know it's been a while since you posted the question, but thought it might come in handy for other people as well.
I had this same issue with a deployed API that was being hit frequently around midday the requests would stop working and fail with { Missing Authentication Token }
My issue was not the URL or a stage that was not deployed but I do know AWS throws that error for both of those reasons.
However I found a command to invalidate the cache of apigateway because in my case I was using a custom domain attached to cloudfront.
aws apigateway flush-stage-cache --rest-api-id 97y41psdkg --stage-name dev
After running this I stopped getting the { Missing Authentication Token }
You need to use "AWS Signature" under the Authorization tab in Postman. See this AWS guide on what to enter into those fields:
http://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-use-postman-to-call-api.html
Please use your resource name end of your api URL.
https://***********.execute-api.us-east-1.amazonaws.com/Stag/number
Here number is my resource name

Create Amazon Cloudfront distribution in a script (Windows)

Is there anywhere a decent full example of creating a distribution (ideally with more than one origin - S3 and an AMS) from the command line? I was a bit dismayed to find that it isn't a case of "aws cloudfront blah blah..."
In Windows, assuming no special tools - though any solution that needs a standalone exe is fine. I have been hinted to use cURL... but can't figure out all the stuff I need to pass in, or indeed how to use cURL to do so - have found it has a -h param for headers...but never used cURL so a bit lost.
Looked http://docs.aws.amazon.com/AmazonCloudFront/latest/APIReference/CreateDistribution.html but am bemused by the sketchiness of the 'example' e.g.
POST /2013-09-27/distribution HTTP/1.1
Host: cloudfront.amazonaws.com
Authorization: AWS authentication string
Date: Thu, 17 May 2012 19:37:58 GMT
Other required headers
...
Where do I find my AWS authentication string?
What are the "Other required headers"
Distribution ID I can find on the Cloudfront admin page on the web
I am totally lost - need the real beginners guide here, step by step, ideally cross referenced to the Cloudfront admin page on the web. I'm a C#/SQL desktop apps dev normally, so this is way out of comfort zone.
Have ended up using the Amazon SDK for .NET
Actually, it probably is a matter of aws cloudfront blah blah
When typing aws cloudfront in a recent version of the AWS CLI one gets:
This service is only available as a preview service.
However, if you'd like to use a basic set of cloudfront commands with the
AWS CLI, you can enable this service by adding the following to your CLI
config file:
[preview]
cloudfront=true
Following this advice, you get the command aws cloudfront create-distribution.
I am personally still struggling to find the correct input for required params like --distribution-config
Running aws configure set preview.cloudfront true did not work for me. In my case (Linux), the following worked:
Edit the file ~/.aws/config and add the content
[preview]
cloudfront=true
To its end. This topic helped, but not mentioned the [brackets].