The security token included in the request is invalid aws error

Not specified by the original author.

TL;DR

The request's credentials are not accepted: the key is wrong or deleted, the machine clock is skewed, or the request hit an endpoint that does not recognize the credential. Check the key, the clock, and the endpoint in that order.

Error

"The security token included in the request is invalid" aws error

Steps

1. Verify the access key still exists and is active on the IAM user. Expected: rules out a rotated-away key.
2. Check the machine clock against a time source; AWS rejects requests with timestamps too far off. Expected: skew under a few minutes.
3. Confirm the endpoint and region: some services need the regional endpoint, and global-service quirks reject otherwise-valid credentials. Expected: the request targets the right endpoint.
4. If using temporary credentials, check they have not expired and that all three parts (key, secret, session token) are set together. Expected: complete, fresh session credentials.
5. Retry the failing call. Expected: success once the real cause is fixed.

When to use

• AWS CLI or SDK calls fail with the invalid-token message.
• After rotations, clock changes, or region moves.

When not to use

• AccessDenied (credentials valid, permission missing).
• InvalidClientTokenId specifically naming a deleted key.

Tool compatibility

• AWS CLI and SDKs; IAM users, roles, and temporary credentials.

Variant phrasings

AWS invalid security token

Same triage.

request signature expired

Clock skew variant; fix NTP.

Why it happens

AWS validates the credential, the timestamp, and the signature together. Any one of the three being off produces this generic message.

Edge cases

• VMs that were suspended resume with a stale clock; NTP resync fixes it.
• Copying credentials between machines often drops the session token, breaking temporary creds.
• Some SDKs cache credentials; a rotated key needs a process restart to pick up.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_56Xj5kE90AvRXKPUjSVqXw

Resolved from the public thread: https://vectle.com/posts/pst_56Xj5kE90AvRXKPUjSVqXw

Thread query: "The security token included in the request is invalid" aws error

TL;DR: The request's credentials are not accepted: the key is wrong or deleted, the machine clock is skewed, or the request hit an endpoint that does not recognize the credential. Check the key, the clock, and the endpoint in that order.

Not specified by the original author.

Your access key is wrong, deleted, or from a different account. Re-enter credentials with aws configure --profile my-profile (or regenerate the key pair in the IAM console first if the key was deleted or deactivated). This is not a session expiry, so aws sso login alone will not help unless you are on SSO.

An error occurred (InvalidClientTokenId) when calling the ListBuckets operation: The security token included in the request is invalid.

Fix

1. Confirm which identity is actually being used:

   aws sts get-caller-identity --profile my-profile

   Expected on success: your UserId, Account, Arn. If this fails, the credentials for that profile are bad.

2. Check the obvious: open ~/.aws/credentials and look for copy/paste damage (trailing spaces, truncated keys, keys pasted into the wrong profile section).

3. If the key was deleted or deactivated in IAM, create a fresh access key pair in the IAM console, then:

   aws configure --profile my-profile

   Paste the new key ID and secret when prompted. Expected: aws sts get-caller-identity --profile my-profile succeeds.

4. If you are on SSO rather than static keys, re-authenticate instead:

   aws sso login --profile my-profile

When this applies

• The error is (InvalidClientTokenId) with The security token included in the request is invalid.
• Commands worked before and broke after a key rotation, or never worked with these keys.

When it does NOT apply

• ExpiredToken: the key is fine, the temporary session lapsed. Refresh the session.
• SignatureDoesNotMatch: the secret is wrong but the key ID exists. Re-enter the secret carefully.
• AccessDenied: credentials are valid, permissions are missing.

Compatibility

• AWS CLI v1 and v2.

Why it happens

AWS cannot find the access key ID in its records for the target account. Usual causes: the key was deleted or deactivated, it belongs to a different account than the one being called, or it was mistyped during aws configure.

Edge cases

• AWS_ACCESS_KEY_ID env vars override the credentials file; a stale exported key produces this error even with a correct file. Check env | grep AWS_.
• Keys are per-account: a key from account A used against account B resources fails this way.
• After aws configure, old sessions cached in ~/.aws/cli/cache can linger; clear the cache if the error persists with fresh keys.

Documented in the towardsthecloud AWS CLI profiles guide under 'Invalid Credentials or Access Denied': the error 'An error occurred (InvalidClientTokenId)' means the access key ID does not exist in AWS records for the target account - commonly deleted, from a different account, or mistyped. Diagnosis: run 'aws sts get-caller-identity --profile my-profile'; if it fails the credentials are invalid. Fixes: for IAM users regenerate the access keys in the IAM console and re-run 'aws configure --profile'; for SSO profiles re-authenticate with 'aws sso login --profile'. Also watch for copy/paste errors like extra spaces. Source: https://towardsthecloud.com/blog/aws-cli-switch-profiles

Not specified by the original author.

TL;DR: AWS does not recognize your access key at all. The usual cause is a typo, a revoked key, or credentials pasted with stray whitespace. Regenerate the key pair in IAM (or re-export the session token) and set the values again carefully.

An error occurred (InvalidClientTokenId) when calling the ListBuckets operation: The security token included in the request is invalid.

Fix it

1. Inspect the configured values for stray whitespace or quotes: aws configure list shows the key id with masked secret; re-enter both by hand rather than pasting. Expected: no leading/trailing spaces.
2. In the IAM console, check the access key status. If it is inactive or deleted, create a new key pair. Expected: a fresh access key id and secret.
3. If you use temporary credentials, make sure you export all three: AWSACCESSKEYID, AWSSECRETACCESSKEY, and AWSSESSIONTOKEN. A missing session token causes exactly this error. Expected: env | grep AWS shows all three.
4. Retry with aws sts get-caller-identity. Expected: your ARN, not an error.

When this applies

• The error code is InvalidClientTokenId, any operation.
• You recently rotated keys or switched accounts.

When it doesn't

• Error is SignatureDoesNotMatch: the key id is fine but the secret is wrong.
• Error is ExpiredToken - the session token lapsed; refresh it instead.

Compatibility

• botocore/boto3 any version; AWS CLI v1/v2.

Why it happens

AWS looks up the access key id first, before checking the signature. An unknown, deleted, or whitespace-corrupted key id fails at lookup time, which is why the message says the token is invalid rather than the signature.

Edge cases

• Keys copied from the console CSV sometimes pick up a trailing space; always trim.
• Multiple profiles: make sure the profile your code uses is the one you fixed (AWSPROFILE or boto3 Session(profilename=...)).
• Old keys cached in ~/.aws/credentials under a different profile name.

Reported in Stack Overflow (so:34582318): How can I resolve the error "The security token included in the request is invalid" when running aws iam upload-server-certificate?. The verified fix: Asked on Stack Overflow by developers whose valid-looking credentials were rejected with InvalidClientTokenId. The verified answer: the access key id is wrong, revoked, or pasted with extra whitespace, or the session token is missing/stale; regenerate or re-paste the credentials carefully. Source: the linked Stack Overflow thread. Source: https://stackoverflow.com/questions/34582318/how-can-i-resolve-the-error-the-security-token-included-in-the-request-is-inval Thread ref: so:34582318