The Security Token included in the Request is Invalid

avatar
Borislav Hadzhiev

Last updated: Feb 26, 2024
3 min

banner

# The Security Token included in the Request is Invalid

The error "the Security Token included in the Request is Invalid" can occur for multiple reasons:

  1. The user's credentials are inactive. Open the IAM console, click on the user, and in the Security Credentials tab, make sure the security credentials of the user are active.

inactive user credentials

  1. The user's access key ID and/or secret access key are incorrect. Verify that the values of your Access key and Secret access key are correct. In case you don't have them, generate new ones and make sure to delete the old keys.

    The AWS CLI resolves the credentials in the following order:

    • It looks for the environment variables AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY.
    • In case the environment variables are not set, it looks in: ~/.aws/credentials on Linux and MacOS and in C:\Users\USERNAME\.aws\credentials on Windows.
  2. The user has forgotten to specify the correct --profile parameter in the call to the AWS CLI (in cases where the default profile is not the desired caller).

  1. The user has switched from temporary MFA (multi-factor authentication) Credentials to User credentials, but has forgotten to unset the AWS_SESSION_TOKEN environment variable or the aws_session_token setting in the credentials file.

  2. The user has Multi-Factor Authentication enabled, but has not set a valid session token in the AWS_SESSION_TOKEN environment variable or aws_session_token setting in the credentials file.

  • To generate temporary MFA credentials, open the IAM console and click on the user. Then copy the MFA device ARN because it's required in the call to the get-session-token API:

mfa device arn

  • Other than the MFA device ARN, you will need an MFA Token from your authenticator app, f.e. Google Authenticator (Most likely a 6-digit code, e.g. 001219).

  • Once you have the MFA device ARN and the MFA Token, call the get-session-token API as follows.

shell
aws sts get-session-token --serial-number MFA_DEVICE_ARN --token-code MFA_TOKEN_CODE
  • The output from the call to the get-session-token will look similar to this.
get-session-token
{ "Credentials": { "SecretAccessKey": "secret-access-key", "SessionToken": "temporary-session-token", "Expiration": "expiration-date-time", "AccessKeyId": "access-key-id" } }
  • To update the credentials in your credentials file, run the aws configure command. The command allows you to set the Access key and Secret access key values, and then you have to also set the session token:
shell
# for default profile aws configure # for profile named admin aws configure --profile admin # set the session token for default profile aws configure set aws_session_token YOUR_SESSION_TOKEN # set the session token for a profile named admin aws configure set aws_session_token YOUR_SESSION_TOKEN --profile admin
  • By default, the session token is temporary and valid for 12 hours.

  • If you prefer the Environment variable approach, set the following environment variables:

shell
# on Linux and macOS export AWS_ACCESS_KEY_ID=YOUR_ACCESS_KEY_ID export AWS_SECRET_ACCESS_KEY=YOUR_SECRET_ACCESS_KEY export AWS_SESSION_TOKEN=YOUR_SESSION_TOKEN # or on Windows setx AWS_ACCESS_KEY_ID=YOUR_ACCESS_KEY_ID setx AWS_SECRET_ACCESS_KEY=YOUR_SECRET_ACCESS_KEY setx AWS_SESSION_TOKEN=YOUR_SESSION_TOKEN

You can issue these commands in bash or zsh on macOS and Linux or in CMD (Command Prompt) on Windows.

Alternatively, you can add the lines to your profile file to set the environment variables every time your PC is booted.

On MacOS and Linux, you can find your profile file at ~/.bashrc, ~/.bash_profile or ~/.zshrc.

# Additional Resources

You can learn more about managing your AWS credentials and using the AWS CLI by checking out the following tutorials:

I wrote a book in which I share everything I know about how to become a better, more efficient programmer.
book cover
You can use the search field on my Home Page to filter through all of my articles.