CognitoIdentityCredentials expired - amazon-web-services

Question

Have got the IdentityPool created and userPool too.
Region, AccountId, IdentityPoolId and roleArn passed as params do hold the correct values.
A call to CognitoIdentityCredentials
AWS.config.region = region;
AWS.config.credentials = new AWS.CognitoIdentityCredentials({
AccountId: accountId,
IdentityPoolId: identityPoolId,
RoleArn: roleArn,
});
returns (sensitive credentials obfuscated)
{
"expired": true,
"expireTime": null,
"refreshCallbacks": [],
"params": {
"AccountId": "9999999999",
"IdentityPoolId": "eu-west-2:bcfbd1c9-1234-1234-1234-423be5c3f7d8",
"RoleArn": "arn:aws:iam: : 999999999:role/Cognito_ElasticSearchIdentityPoolAuth_Role"
},
"data": null,
"_identityId": null,
"_clientConfig": {}
}
I would expect this call to return accessKeyId and sessionToken.
https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/CognitoIdentityCredentials.html

Answer 1

Copied from the CognitoIdentityCredentials API documentation:
If a RoleArn is provided, then this provider gets credentials using the AWS.STS.assumeRoleWithWebIdentity() service operation, after first getting an Open ID token from AWS.CognitoIdentity.getOpenIdToken().
Consequently, I suggest that you try something along the lines, starting with CognitoIdentity.getId():
const getIdParams = {
IdentityPoolId: // ...
AccountId: // ...
Logins: {
'<IdentityProviderName>': 'STRING_VALUE',
/* '<IdentityProviderName>': ... */
}
};
const {IdentityId} = await cognitoidentity.getId(getIdParams).promise();
const openIdTokenParams = {
IdentityId,
Logins: {
'<IdentityProviderName>': 'STRING_VALUE',
/* '<IdentityProviderName>': ... */
}
};
const {Token} = await cognitoidentity.getOpenIdToken(openIdTokenParams).promise();
const assumeWebIdentityParams = {
DurationSeconds: // ...
ProviderId: // ...
RoleArn: // ...
RoleSessionName: // ...
WebIdentityToken: Token
}
const {Credentials} = await sts.assumeRoleWithWebIdentity(assumeWebIdentityParams).promise();
console.log(Credentials);
// prints AccessKeyId, Expiration, SecretAccessKey and SessionToken