<p>I'm trying to migrate Several spring boot services to EKS and they can't retrieve aws credentials from credentials chain and pods are failing with following error: <code>Unable to load credentials from any of the providers in the chain AwsCredentialsProviderChain</code></p>
<p>These are what I've tried so far:</p>
<p>I'm using <a href="https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/credentials.html" rel="nofollow noreferrer">Web identity token from AWS STS</a> for credentials retrieval.</p>
<pre><code>@Bean
public AWSCredentialsProvider awsCredentialsProvider() {
    if (System.getenv(&quot;AWS_WEB_IDENTITY_TOKEN_FILE&quot;) != null) {
        return WebIdentityTokenCredentialsProvider.builder().build();
    }
    return new DefaultAWSCredentialsProviderChain();
}

@Bean
public SqsClient sqsClient(AWSCredentialsProvider awsCredentialsProvider) {
    return SqsClient
            .builder()
            .credentialsProvider(() -&gt; (AwsCredentials) awsCredentialsProvider.getCredentials())
            .region(Region.EU_WEST_1).build();
}

@Bean
public SnsClient snsClient(AWSCredentialsProvider awsCredentialsProvider) {
    return SnsClient
            .builder()
            .credentialsProvider(() -&gt; (AwsCredentials) awsCredentialsProvider.getCredentials())
            .region(Region.EU_WEST_1).build();
}
</code></pre>
<p>The services also have <code>aws-java-sdk-sts</code> maven dependency packaged.</p>
<p>IAM role for the services is also fine and <code>AWS_WEB_IDENTITY_TOKEN_FILE</code> is a also automatically created within pod after each Jenkins build based on K8s manifest file.</p>
<p>From pod I can make GET and POST request to SNS and SQS without any problem.</p>

<p>Problem was fixed.</p>
<p>Main issue was conflicting AWS SDK BOM version with individual models. Also previous version of BOM I was using wasn't supporting AWS SDK v2.x .</p>
<p>These are the main take aways from the issue:</p>
<ol>
<li><p>AWS SDK authenticate services using <a href="https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/credentials.html" rel="nofollow noreferrer">credentials provider chain</a> . The <a href="https://sdk.amazonaws.com/java/api/latest/index.html?software/amazon/awssdk/auth/credentials/DefaultCredentialsProvider.html" rel="nofollow noreferrer">default credential provider</a> chain of the AWS SDK for Java 2.x searches for credentials in your environment using a predefined sequence.</p>
<p>1.1 As of <a href="https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/get-started.html" rel="nofollow noreferrer">AWS SDK for Java 2.x</a> Web identity token from AWS STS is within default provider chain.</p>
<p>1.2 As long as using v2 of the SDK and having the STS dependency makes explicit configuration of Web identity token redundant.</p>
<p>1.3 Make sure candidate service is using AWS SDK v2 as it’ll reduce the configuration code to minimum.</p>
</li>
</ol>
<p>If a candidate service using AWS SDK v1 following configuration should be added as Web identity token isn’t in default provider chain for v1.</p>
<pre><code>@Bean
public AWSCredentialsProvider awsCredentialsProvider() {
    if (System.getenv(&quot;AWS_WEB_IDENTITY_TOKEN_FILE&quot;) != null) {
        return WebIdentityTokenCredentialsProvider.builder().build();
    }    
    return new DefaultAWSCredentialsProviderChain();
}
</code></pre>
<p>Last but not least try to use try to use latest <a href="https://mvnrepository.com/artifact/software.amazon.awssdk/bom" rel="nofollow noreferrer">AWS SDK BOM</a> dependency . <a href="https://github.com/aws/aws-sdk-java-v2" rel="nofollow noreferrer">(currently all modules have the same version, but this may not always be the case)</a></p>
