ErrCodeExpiredTokenException for service response error code "ExpiredTokenException".
The web identity token that was passed is expired or is not valid. Get a new identity token from the identity provider and then retry the request.
ErrCodeIDPCommunicationErrorException for service response error code "IDPCommunicationError".
ErrCodeIDPRejectedClaimException for service response error code "IDPRejectedClaim".
The identity provider (IdP) reported that authentication failed. This might be because the claim is invalid.
If this error is returned for the AssumeRoleWithWebIdentity operation, it can also mean that the claim has expired or has been explicitly revoked.
ErrCodeInvalidAuthorizationMessageException for service response error code "InvalidAuthorizationMessageException".
ErrCodeInvalidIdentityTokenException for service response error code "InvalidIdentityToken".
The web identity token that was passed could not be validated by AWS. Get a new identity token from the identity provider and then retry the request.
ErrCodeMalformedPolicyDocumentException for service response error code "MalformedPolicyDocument".
ErrCodePackedPolicyTooLargeException for service response error code "PackedPolicyTooLarge".
ErrCodeRegionDisabledException for service response error code "RegionDisabledException".
STS is not activated in the requested region for the account that is being asked to generate credentials. The account administrator must use the IAM console to activate STS in that region. For more information, see Activating and Deactivating AWS STS in an AWS Region (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html) in the IAM User Guide.