AWS IAM Identity Center provisioning flow fails with the following error visible in the Okta dashboard:

Automatic provisioning of user <user> to app AWS IAM Identity Center failed: Error while creating user <user>: Bad Request. Errors reported by remote server: Request is unparsable, syntactically incorrect, or violates schema
 

• AWS IAM Identity Center
• Provisioning

This error is returned by the AWS API endpoint and is due to one of the following:

• Every user must have a First name, Last name, Username, and Display name value specified. If any of these values are missing from a user, that user will not be provisioned.
• Usernames should be mapped to attributes that are unique within the Okta directory.
• The following special characters must not be used in attributes that are synchronized with SCIM: <>;:%.
• "" is not supported, fields must either be null or have a literal value, and cannot be an empty string.

When updating a user's address, the following information must be specified: streetAddress, city, state, zipCode, and countryCode. If any of these values are not specified for the Okta user at the time of synchronization, the user or changes to the user will not be provisioned.

This error could also occur if the user is manually sourced on the AWS side.

Please refer to AWS: Configuration Guide for more details.

1. Verify if the error the user has caused is due to one of the following reasons and correct it.

For SCIM synchronization to work:

• Every user must have a First name, Last name, Username, and Display name value specified. If any of these values are missing from a user, that user will not be provisioned.
• Usernames should be mapped to attributes that are unique within the Okta directory.
• The following special characters must not be used in attributes that are synchronized with SCIM: <>;:%.
• When updating a user's address, the following information must be specified: streetAddress, city, state, zipCode, and countryCode. If any of these values are not specified for the Okta user at the time of synchronization, the user or changes to the user will not be provisioned.

2. Also, verify if the user is SCIM-sourced or manually sourced on the AWS side. 
3. Afterward, attempt the user provisioning again. Go to Okta Admin Console and navigate to Dashboard > Tasks.
4. Any failed assignments should appear under Tasks.

5. After identifying the failed task for the user that should be retried, click on Retry Selected.

6. If the issue persists, then please contact AWS support for more details and steps on how to resolve this error.

This particular situation may also occur when a character is present in one of the attribute values, and that character is not recognized by AWS. Use the following website to check the attribute values for hidden non-printable Unicode characters.

Related References

• AWS: Configuration Guide