Menu
I did aws configure and test it worked before. But it didn't work today, I got the the error when tried to get hosted zone
$ aws route53 list-hosted-zones
An error occurred (InvalidClientTokenId) when calling the ListHostedZones operation: The security token included in the request is invalid.
I deleted ~/.aws and did aws configure again, but I still got the same error.
Could you please help? Thanks!
385
You must refresh the credentials before they expire. Another reason for expiration is using the incorrect time. A consistent and accurate time reference is crucial for many server tasks and processes. If your instance's date and time aren't set correctly, the AWS credentials are rejected.
If you're trying to reset your password and you receive an error citing an “invalid token” or asking you for your token, it's likely that the link you clicked on to reset your password has expired. For security reasons, passwords are never sent out across the Internet.
If your credentials and config files contain a single profile, you can just delete the files to clear your AWS CLI credentials. The next time you run the aws configure command, the AWS CLI will automatically re-create them for you.
The GetSessionToken operation must be called by using the long-term AWS security credentials of the AWS account root user or an IAM user. Credentials that are created by IAM users are valid for the duration that you specify.
After you enabled MFA, you will have to pass temporary credentials you received from executing aws sts get-session-token on each future request.
With environment variables:
export AWS_ACCESS_KEY_ID=XXX
export AWS_SECRET_ACCESS_KEY=YYY
export AWS_DEFAULT_REGION=us-east-2
export AWS_SESSION_TOKEN=ZZZ
With named profiles:
[mfa]
aws_access_key_id = XXX
aws_secret_access_key = YYY
aws_session_token = ZZZ
The An error occurred (InvalidClientTokenId) ... error might occur again and again if you forget to remove the previous temporary credentials.
So, if you're using environment variables don't forget to unset all variables before new execution of aws sts get-session-token:
unset AWS_ACCESS_KEY_ID
unset AWS_SECRET_ACCESS_KEY
unset AWS_SESSION_TOKEN
If you're using named profiles - don't forget to update the profile under .aws/credentials.
154
Do you have MFA enabled on your account? You might have to run
aws sts get-session-token
Details for how to use MFA with the cli are documented here.
31
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
