Issue while assuming role using web identity token

Are you certain it's a bug?

• Yes, it looks like a bug

Is the issue caused by a plugin?

• It is not a plugin issue

Are you using the latest version?

• Yes, I'm using the latest version

Is there an existing issue for this?

• I have searched existing issues, it hasn't been reported yet

Issue description

I am running serverless from a container image inside EKS cluster. Serverless should be able to assume necessary role to connect AWS using web identity token as mentioned in the below documentation.
https://www.serverless.com/framework/docs/providers/aws/guide/credentials#using-web-identity-token
I can see the two env variables(AWS_WEB_IDENTITY_TOKEN_FILE and AWS_ROLE_ARN) are set with correct values.

I get below error when I run "serverless deploy".

Serverless: Packaging service...
Serverless: Excluding development dependencies...

Serverless Error ----------------------------------------

The security token included in the request is invalid

Get Support --------------------------------------------
Docs: docs.serverless.com
Bugs: github.com/serverless/serverless/issues
Issues: forum.serverless.com

Your Environment Information ---------------------------
Operating System: linux
Node Version: 16.10.0
Framework Version: 2.64.1
Plugin Version: 5.5.0
SDK Version: 4.3.0
Components Version: 3.17.1

Service configuration (serverless.yml) content

provider:
  name: aws
  runtime: nodejs14.x
  region: af-south-1
  lambdaHashingVersion: '20201221'

functions:
  hello:
    handler: index.hello
    events:
      - http:
          path: /
          method: get

Command name and used flags

SLS_DEBUG=* serverless deploy

Command output

I have masked the WebIdentityToken and RoleArn in the logs below. I have validated and the seems to be correct.

Serverless: Load command slstats
Serverless: Load command plugin
Serverless: Load command plugin
Serverless: Load command plugin:install
Serverless: Load command plugin
Serverless: Load command plugin:uninstall
Serverless: Load command plugin
Serverless: Load command plugin:list
Serverless: Load command plugin
Serverless: Load command plugin:search
Serverless: Load command config
Serverless: Load command config:credentials
Serverless: Load command upgrade
Serverless: Load command uninstall
Serverless: Load command login
Serverless: Load command logout
Serverless: Load command generate-event
Serverless: Load command test
Serverless: Load command dashboard
Serverless: Load command output
Serverless: Load command output:get
Serverless: Load command output:list
Serverless: Load command param
Serverless: Load command param:get
Serverless: Load command param:list
Serverless: Load command studio
Serverless: Skipping variables resolution with old resolver (new resolver reported no more variables to resolve)
Serverless: Invoke deploy
Serverless: Invoke package
Serverless: Invoke aws:common:validate
Serverless: Invoke aws:common:cleanupTempDir
Serverless: Packaging service...
Serverless: Excluding development dependencies...
Serverless: Invoke aws:package:finalize
Serverless: Invoke aws:common:moveArtifactsToPackage
Serverless: Invoke aws:common:validate
Serverless: Invoke aws:deploy:deploy
Serverless: [AWS sts 200 2.796s 0 retries] assumeRoleWithWebIdentity({
  WebIdentityToken: 'X',
  RoleArn: 'arn:aws:iam::248020660386:role/dev-oidc-serverless-deploy',
  RoleSessionName: 'token-file-web-identity'
})
Serverless: [AWS cloudformation 403 2.973s 0 retries] describeStacks({ StackName: 'aws-node-rest-api-project-dev' })

 Serverless Error ----------------------------------------

  ServerlessError: InvalidClientTokenId: The security token included in the request is invalid
      at Request.extractError (/usr/local/lib/node_modules/serverless/node_modules/aws-sdk/lib/protocol/query.js:50:29)
      at Request.callListeners (/usr/local/lib/node_modules/serverless/node_modules/aws-sdk/lib/sequential_executor.js:106:20)
      at Request.emit (/usr/local/lib/node_modules/serverless/node_modules/aws-sdk/lib/sequential_executor.js:78:10)
      at Request.emit (/usr/local/lib/node_modules/serverless/node_modules/aws-sdk/lib/request.js:686:14)
      at Request.transition (/usr/local/lib/node_modules/serverless/node_modules/aws-sdk/lib/request.js:22:10)
      at AcceptorStateMachine.runTo (/usr/local/lib/node_modules/serverless/node_modules/aws-sdk/lib/state_machine.js:14:12)
      at /usr/local/lib/node_modules/serverless/node_modules/aws-sdk/lib/state_machine.js:26:10
      at Request.<anonymous> (/usr/local/lib/node_modules/serverless/node_modules/aws-sdk/lib/request.js:38:9)
      at Request.<anonymous> (/usr/local/lib/node_modules/serverless/node_modules/aws-sdk/lib/request.js:688:12)
      at Request.callListeners (/usr/local/lib/node_modules/serverless/node_modules/aws-sdk/lib/sequential_executor.js:116:18)
      at Request.emit (/usr/local/lib/node_modules/serverless/node_modules/aws-sdk/lib/sequential_executor.js:78:10)
      at Request.emit (/usr/local/lib/node_modules/serverless/node_modules/aws-sdk/lib/request.js:686:14)
      at Request.transition (/usr/local/lib/node_modules/serverless/node_modules/aws-sdk/lib/request.js:22:10)
      at AcceptorStateMachine.runTo (/usr/local/lib/node_modules/serverless/node_modules/aws-sdk/lib/state_machine.js:14:12)
      at /usr/local/lib/node_modules/serverless/node_modules/aws-sdk/lib/state_machine.js:26:10
      at Request.<anonymous> (/usr/local/lib/node_modules/serverless/node_modules/aws-sdk/lib/request.js:38:9)
      at Request.<anonymous> (/usr/local/lib/node_modules/serverless/node_modules/aws-sdk/lib/request.js:688:12)
      at Request.callListeners (/usr/local/lib/node_modules/serverless/node_modules/aws-sdk/lib/sequential_executor.js:116:18)
      at callNextListener (/usr/local/lib/node_modules/serverless/node_modules/aws-sdk/lib/sequential_executor.js:96:12)
      at IncomingMessage.onEnd (/usr/local/lib/node_modules/serverless/node_modules/aws-sdk/lib/event_listeners.js:335:13)
      at IncomingMessage.emit (node:events:402:35)
      at IncomingMessage.emit (node:domain:475:12)
      at endReadableNT (node:internal/streams/readable:1343:12)
      at processTicksAndRejections (node:internal/process/task_queues:83:21)
  ----------------------------------------------------------------------------------------------------
      at /usr/local/lib/node_modules/serverless/lib/aws/request.js:225:11
      at processTicksAndRejections (node:internal/process/task_queues:96:5)
      at async persistentRequest (/usr/local/lib/node_modules/serverless/lib/aws/request.js:149:14)

  Get Support --------------------------------------------
     Docs:          docs.serverless.com
     Bugs:          github.com/serverless/serverless/issues
     Issues:        forum.serverless.com

  Your Environment Information ---------------------------
     Operating System:          linux
     Node Version:              16.10.0
     Framework Version:         2.64.1
     Plugin Version:            5.5.0
     SDK Version:               4.3.0
     Components Version:        3.17.1

Environment information

Framework Core: 2.64.1
Plugin: 5.5.0
SDK: 4.3.0
Components: 3.17.1

Same command works if I set the profile with,
export AWS_ACCESS_KEY_ID=
export AWS_SECRET_ACCESS_KEY=

Start by reproducing serverless deploy in the described EKS container with AWS_WEB_IDENTITY_TOKEN_FILE and AWS_ROLE_ARN, then inspect the AWS credential flow around the assumeRoleWithWebIdentity call and lib/aws/request.js. Done means deployment succeeds with web identity credentials and the invalid-token error is covered by a regression test.