An error occurred (UnrecognizedClientException) when calling the ListClusters operation: The security token included in the request is invalid

Question

https://aws.amazon.com/cn/premiumsupport/knowledge-center/iam-assume-role-cli/

Refer to this tutorial, run aws sts get-caller-identity to see that the identity has been switched correctly, but encounter the following error when running 
```
aws eks list-clusters --region ap-east-1
```

There is no problem in specifying other areas. I have confirmed that both account A and account B have enabled the ap-east-1 region.
The trust relationship for the IAM role is as follows:

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::accountA:root"
            },
            "Action": "sts:AssumeRole",
            "Condition": {}
        }
    ]
}
```

I can run the same command normally in cloudshell, why is this?

Answer

When encountering the UnrecognizedClientException error in the ap-east-1 region with AWS EKS and assuming it works in other regions and CloudShell, consider these potential issues:

**Temporary Credentials**: There might be a delay in the propagation of temporary credentials obtained through sts assume-role.

**IAM Role Permissions**: Ensure the assumed role has permissions for eks:ListClusters and no explicit deny policies are affecting ap-east-1.

**Region-Specific Restrictions**: Check for any account or organizational policies that might restrict actions in the ap-east-1 region.

**CLI Configuration**: Verify that your local AWS CLI is up to date and the environment variables are correctly set after assuming the role.

**Token Validity**: Make sure the session token hasn't expired; the default duration is 1 hour, but it can be extended up to 12 hours.

Answer

Hi,

Security token is invalid - It appears credentials are not correct. Assuming you're trying cross account access.

Follow this article to ensure the IAM role and policies are defined correctly - https://aws.amazon.com/premiumsupport/knowledge-center/cross-account-access-iam/

And then use this page to access as - https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-cli.html

An error occurred (UnrecognizedClientException) when calling the ListClusters operation: The security token included in the request is invalid

Relevant content