How do I resolve the IAM access key error "The security token included in the request isn’t valid"?

Short description

This authentication error occurs because your IAM access keys are in an unexpected location, aren't configured correctly, or are deleted or expired. The access keys used depend on the order and precedence of the credential providers. For more information, see Configuration and credentials precedence.

In the following resolution, the error occurs on a Linux-based Amazon Elastic Compute Cloud (Amazon EC2) instance because of invalid access keys.

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshoot AWS CLI errors. Also, make sure that you're using the most recent AWS CLI version.

To resolve this error, find the user credential location, verify that the access keys are valid, and then update or replace the access keys.

Find the user credential location

To get the IAM access keys used by the EC2 instance, run the following get-caller-identity AWS CLI command:

aws sts get-caller-identity --debug

Example output:

2024-06-04 11:28:22,588 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: env
2024-06-04 11:28:22,588 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: assume-role
2024-06-04 11:28:22,588 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: assume-role-with-web-identity
2024-06-04 11:28:22,588 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: sso
2024-06-04 11:28:22,588 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: shared-credentials-file
2024-06-04 11:28:22,588 - MainThread - botocore.credentials - INFO - Found credentials in shared credentials file: ~/.aws/credentials

In the preceding example output, the access keys used by the Amazon EC2 instance are inside the: ~/.aws/credentials file.

Note: The .aws/credentials file contains credential details for your IAM entities. When you manage your access keys, verify that you follow security best practices in IAM.

Verify that the access keys are valid

To verify that the access keys are valid for the location and API call action, complete the following steps:

1. To verify which access keys are used by the Amazon EC2 instance, run the following commands:

   cd ~/.aws
   cat credentials

   Example output:

   [default]
   aws_access_key_id=AKIAIOSFODNN7EXAMPLE
   aws_secret_access_key=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

2. To verify that the access key permissions are valid, use the AWS Management Console or the AWS CLI.

Update or replace the access keys

If the access keys are expired or deleted, then update the access keys.

If you use a named profile with the AWS CLI, then verify that the aws_access_key_id and aws_session_token settings have the correct values. The profile settings are stored in the ./aws/credentials or ./aws/config files.

If you have access keys stored in environment variables that aren't valid, then run the following command to remove them:

unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN

If you updated your profile settings, then make sure that you reset the environment variables.

After you have updated or replaced the access keys, to verify that the credentials are valid, run the following get-caller-identity AWS CLI command:

aws sts get-caller-identity --debug

Example output:

2024-06-04 12:46:07,167 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: env
2024-06-04 12:46:07,167 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: assume-role
2024-06-04 12:46:07,168 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: assume-role-with-web-identity
2024-06-04 12:46:07,168 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: sso
2024-06-04 12:46:07,168 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: shared-credentials-file
2024-06-04 12:46:07,168 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: custom-process
2024-06-04 12:46:07,168 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: config-file
2024-06-04 12:46:07,169 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: ec2-credentials-file
2024-06-04 12:46:07,169 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: boto-config
2024-06-04 12:46:07,169 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: container-role
2024-06-04 12:46:07,169 - MainThread - botocore.credentials - DEBUG - Looking for credentials via: iam-role
2024-06-04 12:46:07,177 - MainThread - botocore.credentials - DEBUG - Found credentials from IAM Role: ec2_Role

In the preceding example output, Amazon EC2 instance profile credentials are used by the instance because there are no other credentials stored with a higher precedence.

Resolve ExpiredToken errors with temporary security credentials

Note: It's a best practice to use temporary security credentials instead of long-term security credentials such as access keys. For more information about security provisions for your AWS account, see Security considerations.

Temporary security credentials expire after a specified duration and can't be extended beyond their original expiration time. When you use expired credentials, you receive an ExpiredToken error.

To resolve this error, you must request new temporary credentials. If you originally used GetSessionToken to obtain temporary credentials, then to request new credentials, run the following get-session-token AWS CLI command:

aws sts get-session-token \
    --duration-seconds 3600

Note: Replace 3600 with your desired session duration in seconds. The minimum is 900 seconds, and the maximum is 129600 seconds.

For code examples on how to use GetSessionToken, see Use GetSessionToken with an AWS SDK or CLI.

Related information

Why is my Amazon EC2 instance using IAM user credentials instead of role credentials?

How do I resolve the IAM error "AWS was not able to validate the provided access credentials" in some Regions?

Manage AWS STS in an AWS Region