What causes "Incorrect token audience" using Google authentication tokens with AWS
<p>I'm creating a simple web application that will use Google authentication to return an OpenID token, and then pass that token to AWS using javascript WebIdentityCredentials. </p>

<p>What I have done:</p>

<ol>
<li>Created the Google Project, and saved the OAuth ClientID</li>
<li>Created an IAM role using Google IDP, and OAuth ClientID as Audience field.</li>
<li>Include both Google API and AWS API javascript in web page configured with above.</li>
<li>(Client) Request the id token from Google using the google js api </li>
<li>Configure the id token on an WebIdentityCredentials</li>
<li>Retrieve the AWS credentials (using that token) </li>
</ol>

<p>When retrieving the credentials, I get this error from STS:</p>

<pre><code>&lt;ErrorResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/"&gt;
  &lt;Error&gt;
    &lt;Type&gt;Sender&lt;/Type&gt;
    &lt;Code&gt;InvalidIdentityToken&lt;/Code&gt;
    &lt;Message&gt;Incorrect token audience&lt;/Message&gt;
  &lt;/Error&gt;
  &lt;RequestId&gt;28d09368-bf98-11e5-b52f-953b4c773ebf&lt;/RequestId&gt;
&lt;/ErrorResponse&gt;
</code></pre>

<p>Here is the AWS role:</p>

<pre><code>{
  "Version": "2012-10-17",
  "Statement": [{
      "Effect": "Allow",
      "Principal": {"Federated": "accounts.google.com"},
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "accounts.google.com:aud": "&lt;my-oauth-client-id&gt;"
        }
      }
    }
  ]
}
</code></pre>

<p>And here is the code I use to configure the token on the AWS context:</p>

<pre><code>AWS.config.update({
   region: 'us-east-1',
   credentials: new AWS.WebIdentityCredentials({
     RoleArn: 'arn:aws:iam::&lt;my-acct&gt;:role/lab-amp-google-idp',
     WebIdentityToken : token
   })
});
</code></pre>

<p>And here is where I test the credentials by fetching them:</p>

<pre><code>AWS.config.credentials.get(function(err) {
   if (err) console.log(err);
   else console.log(AWS.config.credentials);
});
</code></pre>

<p>I have validated the id token using jwt.io and I can see it has the proper expected fields. The "aud" and "azp" properties have the OAuth Client ID. I also double checked the Trust stansza in the AWS role to confirm it also has the exact same OAuth Client ID in the Condition. </p>

<p>I have passed in other invalid tokens and altered the RoleArn just to see the different errors, which I do. </p>

<p>I cannot find anything on the web describing reasons for "Incorrect token audience" so I'm at a loss for what to try next. </p>