为何一台AWS实例可通过WIF调用Google Cloud Run，另一台不行？

一台AWS EC2实例可通过Workflow Identity Federation（WIF）成功调用Google Cloud Run服务，但另一台配置相同权限的实例调用失败。GCP权限设置未指定实例ID，仅通过角色限制权限，且两台EC2实例均已关联对应角色。

调用失败时出现以下错误：

GaxiosError: <?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
 <head>
  <title>401 - Unauthorized</title>
 </head>
 <body>
  <h1>401 - Unauthorized</h1>
 </body>
</html>

    at Gaxios._request (/home/ubuntu/trader2/node_modules/gaxios/build/src/gaxios.js:141:23)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async AwsClient.getAwsRegion (/home/ubuntu/trader2/node_modules/google-auth-library/build/src/auth/awsclient.js:196:26)
    at async AwsClient.retrieveSubjectToken (/home/ubuntu/trader2/node_modules/google-auth-library/build/src/auth/awsclient.js:102:27)
    at async AwsClient.refreshAccessTokenAsync (/home/ubuntu/trader2/node_modules/google-auth-library/build/src/auth/baseexternalclient.js:283:30)
    at async AwsClient.getAccessToken (/home/ubuntu/trader2/node_modules/google-auth-library/build/src/auth/baseexternalclient.js:160:13)
    at async AwsClient.getRequestHeaders (/home/ubuntu/trader2/node_modules/google-auth-library/build/src/auth/baseexternalclient.js:177:37)
    at async AwsClient.getProjectId (/home/ubuntu/trader2/node_modules/google-auth-library/build/src/auth/baseexternalclient.js:216:29)
    at async GoogleAuth.getExternalAccountClientProjectId (/home/ubuntu/trader2/node_modules/google-auth-library/build/src/auth/googleauth.js:605:16)
    at async GoogleAuth.findAndCacheProjectId (/home/ubuntu/trader2/node_modules/google-auth-library/build/src/auth/googleauth.js:157:35)

排查方向 #

• 检查EC2角色信任关系：确认两台实例关联的IAM角色信任策略完全一致，没有针对特定实例ARN、区域或账户的限制。
• 测试实例元数据访问：在失败的实例上执行curl http://169.254.169.254/latest/dynamic/instance-identity/document，验证是否能正常获取区域、实例ID等元数据——错误栈显示getAwsRegion步骤失败，说明元数据访问可能受阻。
• 核对WIF身份池映射规则：检查GCP身份池的属性映射配置，确保AWS角色ARN的匹配规则（如通配符）覆盖了失败实例的角色，没有遗漏或匹配错误。
• 对比依赖库版本：检查两台实例的google-auth-library版本是否一致，尝试将失败实例的依赖升级到与成功实例相同的版本，或最新稳定版。
• 排查网络限制：确认失败实例所在VPC的安全组、NACL规则允许HTTPS（443端口）出站访问sts.amazonaws.com及GCP身份服务相关域名。
• 清除令牌缓存：重启Node.js应用或删除实例上的令牌缓存文件（如~/.config/gcloud下的缓存内容），避免旧缓存导致的验证失败。

内容的提问来源于stack exchange，提问作者BenTaylor