From e456d891a46f8f3cb9d1e23fa6caf8ed09d8fe0c Mon Sep 17 00:00:00 2001
From: Chris Lu <chrislusf@users.noreply.github.com>
Date: Fri, 13 Nov 2026 03:10:09 -0800
Subject: [PATCH] sts: drop a token-supplied aws:userid when a session has no
 parent user

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 weed/iam/sts/sts_service.go | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/weed/iam/sts/sts_service.go b/weed/iam/sts/sts_service.go
index 5b4f6ae311..81e7ea39f1 100644
--- a/weed/iam/sts/sts_service.go
+++ b/weed/iam/sts/sts_service.go
@@ -699,6 +699,8 @@ func (s *STSService) AssumeRoleWithWebIdentity(ctx context.Context, request *Ass
 		// Surface as aws:userid so policies can reference it directly without
 		// caring about token-rotation churn.
 		requestContext["aws:userid"] = parentUser
+	} else {
+		delete(requestContext, "aws:userid")
 	}
 
 	// Surface principal session tags as aws:PrincipalTag/<key>. The OIDC