Aws-vault: Failed to get credentials - InvalidClientTokenId: The security token included in the request is invalid

Question

When I use

aws-vault exec --no-session --debug role_name

I get:

2020/06/09 13:57:13 [keyring] Found item "aws-vault (default)"
aws-vault: error: exec: Failed to get credentials for role_name: InvalidClientTokenId: The security token included in the request is invalid.
        status code: 403, request id: 05bf31bd-091e-4f18-83c5-7add3e1bccb8

First of all I thought about incorrect password, but when tried to put an incorrect password purposely, Mac Os ask again for the correct password.

I have the ~/.aws/config and ~/.aws/credentials with the correct setup.

Answer 1

Had the same error after rotating AWS credentials.
Deleted ~/Library/Keychains/aws-vault.keychain-db and executed aws-vault add default which created a new keychain and aws-vault started working again.

If you are on MacOS, you can probably edit the keychain directly.