apiVersion: v1
kind: Secret
metadata:
  name: iam-cluster-credentials
type: Opaque
data:
  accessKey: ...
  secretAccessKey: ...

apiVersion: generators.external-secrets.io/v1alpha1
kind: STSSessionToken
metadata:
  name: sts-gen
spec:
  auth:
    secretRef:
      accessKeyIDSecretRef:
        key: accessKey
        name: iam-cluster-credentials
      secretAccessKeySecretRef:
        key: secretAccessKey
        name: iam-cluster-credentials
  region: eu-west-1
  requestParameters:
    sessionDuration: 3600
  role: arn:aws:iam::1234567890:role/my-role

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: sts
spec:
  dataFrom:
    - sourceRef:
        generatorRef:
          apiVersion: generators.external-secrets.io/v1alpha1
          kind: STSSessionToken
          name: sts-gen
  refreshInterval: 1h
  target:
    name: sts

{"level":"debug","ts":"2025-05-08T10:28:42.614Z","logger":"provider.aws","msg":"using credentials from secretRef"}
{"level":"info","ts":"2025-05-08T10:28:42.714Z","logger":"provider.aws","msg":"using aws session","region":"eu-west-1","credentials":{}}
{"level":"debug","ts":"2025-05-08T10:28:43.412Z","logger":"events","msg":"error processing spec.dataFrom[0].sourceRef.generatorRef, err: error using generator: unable to get authorization token: AccessDenied: Cannot call GetSessionToken with session credentials\n\tstatus code: 403, request id: a47ce8db-d230-482d-b323-fddafb97cf49","type":"Warning","object":{"kind":"ExternalSecret","namespace":"memento","name":"local-sts","uid":"6655e0c6-3a21-4d5b-893c-618970f199cc","apiVersion":"external-secrets.io/v1beta1","resourceVersion":"12282826"},"reason":"UpdateFailed"}
{"level":"error","ts":"2025-05-08T10:28:43.502Z","msg":"Reconciler error","controller":"externalsecret","controllerGroup":"external-secrets.io","controllerKind":"ExternalSecret","ExternalSecret":{"name":"local-sts","namespace":"memento"},"namespace":"memento","name":"local-sts","reconcileID":"6b21a3ed-9722-46b1-a1ff-38f41ef8b615","error":"error processing spec.dataFrom[0].sourceRef.generatorRef, err: error using generator: unable to get authorization token: AccessDenied: Cannot call GetSessionToken with session credentials\n\tstatus code: 403, request id: a47ce8db-d230-482d-b323-fddafb97cf49","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.4/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.4/pkg/internal/controller/controller.go:263\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.2\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.4/pkg/internal/controller/controller.go:224"}