Borislav Hadzhiev
Wed Sep 15 2021·3 min read
Photo by Azka Nurakli
The error "the Security Token included in the Request in Invalid" can occur for multiple reasons:
Security Credentials
tab, make sure the security
credentials of the user are active.The user's access key ID and / or secret access key are incorrect. Verify that the values of your access key and secret access key are correct, or in case you don't have them generate new ones and make sure to delete the old keys.
The AWS CLI resolves the credentials in the following order:
AWS_ACCESS_KEY_ID
and
AWS_SECRET_ACCESS_KEY
~/.aws/credentials
on Linux
and macOS
and in
C:\Users\USERNAME\.aws\credentials
on Windows
.The user has forgotten to specify the correct --profile
parameter in the
call to the AWS CLI (in cases where the default profile is not the desired
caller).
The user has switched from temporary MFA Credentials to User credentials,
but forgot to unset the AWS_SESSION_TOKEN
environment variable or the
aws_session_token
setting in the credentials
file.
The user has Multi Factor Authentication enabled, but has not set a valid
session token in the AWS_SESSION_TOKEN
environment variable or
aws_session_token
setting in the credentials
file.
get-session-token
API:Other than the MFA device ARN, you will need an MFA Token, from your authenticator app, f.e. Google Authenticator (Most likely a 6 digit code, e.g. 001219).
Once you have the MFA device ARN and the MFA Token, call the
get-session-token
API:
aws sts get-session-token --serial-number MFA_DEVICE_ARN --token-code MFA_TOKEN_CODE
get-session-token
will look something like:{ "Credentials": { "SecretAccessKey": "secret-access-key", "SessionToken": "temporary-session-token", "Expiration": "expiration-date-time", "AccessKeyId": "access-key-id" } }
credentials
file, run the aws configure
command, it allows you to set the access key and secret access key values,
then you have to also set the session token:# for default profile aws configure # for profile named admin aws configure --profile admin # set the session token for default profile aws configure set aws_session_token YOUR_SESSION_TOKEN # set the session token for a profile named admin aws configure set aws_session_token YOUR_SESSION_TOKEN --profile admin
Note that the session token is temporary and valid for 12 hours by default
If you prefer the Environment variable approach you can set the following environment variables:
# on Linux and macOS export AWS_ACCESS_KEY_ID=YOUR_ACCESS_KEY_ID export AWS_SECRET_ACCESS_KEY=YOUR_SECRET_ACCESS_KEY export AWS_SESSION_TOKEN=YOUR_SESSION_TOKEN # on Windows setx AWS_ACCESS_KEY_ID=YOUR_ACCESS_KEY_ID setx AWS_SECRET_ACCESS_KEY=YOUR_SECRET_ACCESS_KEY setx AWS_SESSION_TOKEN=YOUR_SESSION_TOKEN