ARTIFACTORY: How to resolve the error “The provided token is malformed or otherwise invalid” while attempting to connect the S3 bucket from Artifactory through the EKS cluster

Overview

It is possible to configure Artifactory to use IAM Role to connect with s3 bucket through EKS by using the instructions available below

1. https://jfrog.com/help/r/artifactory-how-to-configure-an-aws-s3-object-store-using-an-iam-role-instead-of-an-iam-user/artifactory-how-to-configure-an-aws-s3-object-store-using-an-iam-role-instead-of-an-iam-user
2. https://jfrog.com/help/r/active/artifactory-connect-artifactory-to-s3-bucket-with-iam-role

However, when hosting the EKS cluster in certain regions like ap-south-2, it is required to make certain changes at the AWS configuration.

The Global and Regional Endpoint for Security Token Service (STS) available under "Identity and Access Management (IAM) -> Access management -> Account settings are set to "AWS Regions enabled by default".

When hosting the EKS cluster and the S3 bucket on ap-south-2, It is required to change the Global and Regional Endpoints to “Valid in all AWS Regions” to validate service tokens within the pod.

At the time of startup, Artifactory would try to perform the connectivity test by performing an object upload to s3. When using the  "AWS Regions enabled by default" option at AWS, the startup would fail as the tokens/IAM role created using the service accounts is not validated by the STS present within the pod.

An error message is shown during the startup:

Application could not be initialized: The ap-south-2 location constraint is incompatible for the region specific endpoint this request was sent to. (Service: Amazon S3; Status Code: 400; Error Code: IllegalLocationConstraintException; Request ID: 2RNNV75WK94TB6BX; S3 Extended Request ID: IwDxhodLUwieCnMXmhG0FO9CREbqX8U6rhBZdOBCu/PaCSctL+mQBMLK91nb86IVjS4pXHXXYyM=; Proxy: null)

Application could not be initialized: The provided token is malformed or otherwise invalid. (Service: Amazon S3; Status Code: 400; Error Code: InvalidToken; Request ID: 2RNNV75WK94TB6BX; S3 Extended Request ID: 0yWN+N5v/IwDxhodLUwieCnMXmhG0FO9CREbqX8U6rhBZdOBCu+xgACuB84YvpJWs/g85w0IivdoJ3jnEpT=; Proxy: null)

Hence, to overcome this issue, it is expected to update the values as shown below