title: "The AWS Access Key Id you provided does not exist in our records" during a federation with Salesforce
body: <p>I'm trying to establish a federation among Amazon and Salesforce, in this way: if a user correctly authenticates through Salesforce it will see all S3 buckets in the given account.</p>
  
  <p>Quite simple, I followed <a href="https://aws.amazon.com/blogs/security/building-an-app-using-amazon-cognito-and-an-openid-connect-identity-provider/" rel="nofollow noreferrer">this blog post</a> and changed something (i.e. I don't use a DyanamoDb table and the callback is for simplicity inside an S3 bucket). The flow that I'm trying to implement is called Enhanced (simplified) flow (details <a href="https://aws.amazon.com/blogs/mobile/understanding-amazon-cognito-authentication-part-4-enhanced-flow/" rel="nofollow noreferrer">here</a>):</p>
  
  <p><a href="https://i.stack.imgur.com/Wgzxb.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Wgzxb.png" alt="Enhanced simplified flow"></a></p>
  
  <p>I slightly modified the callback code compared to the article:</p>
  
  <pre><code>function onPageLoad() {
      var url = window.location.href;
      var match = url.match('id_token=([^&amp;]*)');
      var id_token = "";
  
      if (match) {
          id_token = match[1];
      } else {
          console.error("Impossibile recuperare il token");
      }
  
      AWS.config.region = "eu-west-1"
      const cognitoParams = {
          AccountId: "ACC_ID",
          IdentityPoolId: "eu-west-1:XXX",
          Logins: {
              "login.salesforce.com": id_token
          }
      }
  
      const identity = new AWS.CognitoIdentity()
  
      identity.getId(cognitoParams, function (err, identityData) {
          if (err) {
              printMessage(err);
              return;
          }
  
          const identityParams = {
              IdentityId: identityData.IdentityId,
              Logins: cognitoParams.Logins
          }
  
          identity.getCredentialsForIdentity(identityParams, function (err, data) {
              if (err) {
                  printMessage(err);
              } else {
                  var c = {
                      region: 'eu-west-1',
                      accessKeyId: data.Credentials.AccessKeyId,
                      secretAccessKey: data.Credentials.SecretKey
                  };
                  var s3 = new AWS.S3(c);
  
                  // HERE IS THE ERRORE - data is empty and response contains the error
                  s3.listBuckets((response, data) =&gt; {
                      data.Buckets.forEach(function (value) { appendMessage(value.Name) })
                  });
              }
          });
      });
  
      // IRRELEVANT CODE
  }
  </code></pre>
  
  <p>I can get the token from Salesforce, I can get the access and secret keys  but when I try to list the buckets I get a laconic:</p>
  
  <blockquote>
    <p>The AWS Access Key Id you provided does not exist in our records.</p>
  </blockquote>
  
  <p>I found this error reasonable since I have no user at all and the keys are created on-the-fly. Where can I hit my head? The SDK is 2.103.0.</p>