Unable to determine the default AWS account: IncompleteSignature not a valid key=value pair (missing equal-sign) in Authorization header - when using CDK on Gitlab CICD

[bdb2381]

When I cdk deploy the stack locally, everything works as expected. But when I deploy via Gitlab CICD process, CDK gives this error: Error: Need to perform AWS calls for account 21............., but no credentials have been configured

I've tracked down issue (using cdk deploy --verbose) to the below issue:

Toolkit stack: CDKToolkit
Setting "CDK_DEFAULT_REGION" environment variable to us-east-1
Resolving default credentials
Looking up default account ID from STS

Unable to determine the default AWS account: IncompleteSignature: '/20210920/us-east-1/sts/aws4_request' 
not a valid key=value pair (missing equal-sign) in Authorization header: 'AWS4-HMAC-SHA256 Credential= /20210920/us-east-1/sts/aws4_request, 

SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=e30ef933fae1de698850a1a75b3e258b5263c480497d2587727861a7e655e59b'.

Questions
What is the root cause of the incomplete signature?
Is it on Gitlab side or AWS CDK side? Or the interplay?

Clearly the credential is missing.

Setup

• Gitlab has the creds (access, secret, and region) set as env vars for the default dev account and spelled correctly.
• The account number is hardcoded currently in the app.py file
• gitlab-ci.yml, if it helps:

dev-build-deploy-job:
  stage: dev
  rules: 
    - if: '$CI_COMMIT_BRANCH == "dev"'
  script: 
    - echo "Installing packages..."
    - apt-get -qq update && apt-get -y install nodejs npm
    - node -v
    - npm i -g aws-cdk
    - pip3 install awscli
    - pip3 install -r requirements.txt
    - npm --version 
    - mkdir ~/.aws/ 
    - touch ~/.aws/credentials 
    - touch ~/.aws/config 
    - aws configure set aws_access_key_id "$AWS_ACCESS_KEY_ID"
    - aws configure set aws_secret_access_key "$AWS_SECRET_ACCESS_KEY"
    - aws configure list
    - cdk deploy --verbose --require-approval never 
  environment: 
    name: dev/$CI_COMMIT_REF_NAME

Resources Followed
This StackOverlow
This blog post

[bdb2381]

Thanks to a prompt from Brian Caffey, I didn't give/forgot to give the dev branch access to the creds in Gitlab.

Once I set the dev branch to 'protected', everything works as expected.