This is not related to that @vadmeste - this code path is used to validate only the JWT token for Prometheus which is never signed with secret key from root.     This is not about decoding the session-token from the STS credentials.