SailPoint AWS Vault - "Failed to load credentials from IMDS" while retrieving secrets

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

Hi Developers

I’m integrating SailPoint IdentityNow with AWS Secrets Manager using the AWS Vault credential provider, specifically to retrieve credentials for Active Directory (AD) using the SailPoint connector.
I have checked “use credential Provider” option in AD base configuration.

I’ve configured the secret path in accordance with SailPoint documentation and constructed the following credential path:

secrets://aws-vault/uncoded ARN/password

But I am getting below error:
Failed to load credentials from IMDS. Please verify provided secret expression.

Can someone faced same issue ?

Please assist me to resolve this.

Regards
Vatan

1 Like
2

Hi @Vatanjain11,

Here is a checklist of potential issues:

  1. Improper formatting of the Credential Path
  • The ARN needs to be URL Encoded.
  • Prefixes/Suffixes should be added as needed.
  1. Insufficient IAM Role permissions
  • The AWS account is missing the “secretsmanager:GetSecretValue” or
    “secretsmanager:DescribeSecret” permissions
  1. IMDS hop count is set to 1
  • The IMDS hop count should be set to 2 to avoid 401 errors
3

Hi Vatan

  1. Check the Credential Path Format
    Make sure your credential expression follows this format exactly:

  2. Confirm the Secret Format in AWS Secrets Manager
    Your secret should be in JSON format like:
    json
    Copy
    Edit
    {
    “username”: “ADAdmin”,
    “password”: “SuperSecret123!”
    }
    Make sure:
    The key you are referencing in the expression (e.g., password) exists
    There are no typos or case mismatches

  3. IAM Role Permissions
    Also, make sure no SCP or session policies are blocking access.

  4. VA Network Access to AWS Secrets Manager
    Confirm that the VA has network connectivity to AWS Secrets Manager endpoint
    If using a VPC endpoint, ensure DNS resolution and security groups/NACLs allow traffic

  5. Validate the VA is Configured with AWS Vault Provider

  6. Logging for More Clues
    Enable debug-level logging in IdentityNow for the AD connector and look for:

If you are currently using this:
bash
Copy
Edit
secrets://aws-vault/uncoded ARN/password
Try switching to:
ruby
Copy
Edit
secrets://aws-vault/arn:aws:secretsmanager:us-east-1:123456789012:secret:my-ad-secret/password

4

Hi Satish

Is it compulsory to have same name of AWS vault and ISC credential provider. ?

Thanks

5

Hi Vatan
No, it is not compulsory to have the same name for the AWS Secrets Manager secret name (vault name) and the IdentityNow (ISC) credential provider name.

When configuring the AD connector in IdentityNow:
You check “Use Credential Provider”
You set the Credential Provider name to “aws-vault” (case-sensitive)

This tells IdentityNow to use the AWS Secrets Manager integration (via the aws-vault plugin/handler) instead of the default or IMDS.

6

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.