0

I have an account in us-gov-west-1 region. Inside the AWS console cloudshell, I'm trying to run aws-cli commands. It looks like IAM calls fail, but others work. Every time I'm trying to run a IAM command, I get the following error:

An error occurred (InvalidClientTokenId) when calling the ListUsers operation: The security token included in the request is invalid

See this screenshot: enter image description here

r/aws - IAM cli commands having issues in gov? I tried:

  • Logging in and out of the account several times.
  • Delete AWS Cloudshell home directory and starting over.
  • Creating a new role with admin permissions, assuming it and calling the commands. All providing the same error, for every iam command I tried to run. I also have another account in a standard region with similar configurations and everything works properly there. The user I'm logging to the console with had admin permissions.

Does anyone have any idea? is it something related to gov?

Improve this question
4
  • Strange. Suggest re-running with --debug to see if that provides useful info. Also, while I wouldn't expect that error, do you actually have IAM permissions? Or are you perhaps missing MFA information required for the IAM calls? Commented Feb 19 at 22:15
  • When you say "having issues", are you saying that this method previously worked for you? Or have you never tried it this way previously? Commented Feb 20 at 2:10
  • Command Line and API Access - AWS GovCloud (US) suggests you might need to specify --endpoint-url https://s3-fips.us-gov-west-1.amazonaws.com --region us-gov-west-1 in your command. Commented Feb 20 at 2:11
  • Have you checked if it's simply because you have to supply MFA to use IAM APIs? If so, you'd have to use aws sts get-session-token supplying the MFA serial number and token code, which would get you STS credentials that you can then use to call IAM APIs. Commented Feb 21 at 15:14
Related questions
259
How can I resolve the error "The security token included in the request is invalid" when running aws iam upload-server-certificate?
285
AccessDenied for ListObjects for S3 bucket when permissions are s3:*
45
AWS CLI listing S3 buckets gives SignatureDoesNotMatch error using IAM user credentials
Load 5 more related questions Show fewer related questions

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.