Replace Modal OIDC helper with manual STS assume role flow#975
Merged
r33drichards merged 1 commit intoclaude/add-s3-docs-mcp-upload-Xwis5from Feb 2, 2026
Merged
Conversation
The modal.oidc.assume_role() API doesn't exist. Modal provides OIDC tokens via the MODAL_IDENTITY_TOKEN environment variable, which must be exchanged for AWS credentials using boto3's STS client with assume_role_with_web_identity(). https://claude.ai/code/session_013E7ycxMooFL1t9wkgbN7UA
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
r33drichards
merged commit 73f3b54
into
claude/add-s3-docs-mcp-upload-Xwis5
2 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Updated the AWS credential acquisition flow in the Modal app to manually exchange Modal's OIDC token for temporary AWS credentials using STS
assume_role_with_web_identity, replacing the previousmodal.oidc.assume_role()helper method.Changes
modal.oidc.assume_role()call with explicit STS token exchange flowMODAL_IDENTITY_TOKENfrom environment variable (provided by Modal runtime)assume_role_with_web_identity()with the OIDC tokencreds.access_key_id→creds["AccessKeyId"])MODAL_IDENTITY_TOKENis set, with helpful error messageImplementation Details
MODAL_IDENTITY_TOKENenvironment variableAccessKeyId,SecretAccessKey,SessionToken)"modal-docs-mcp-upload"for audit trail clarityhttps://claude.ai/code/session_013E7ycxMooFL1t9wkgbN7UA