Why did Aws-vault auth failed? error using credentials to get account ID: error calling sts:GetCallerIdentity: InvalidClientTokenId

user_4723732 0
Viewed 193

I am using aws-vault to store my credenitals After running

docker-compose -f deploy/docker-compose.yml run --rm terraform init

I got error

Initializing the backend...

Error: error using credentials to get account ID: error calling sts:GetCallerIdentity: InvalidClientTokenId: The security token included in the request is invalid
    status code: 403, request id: 6ee874fd-9f27-4923-a6ac-b605ae49879d

I checked again

aws-vault list

shows

brankovich                brankovich                sts.GetSessionToken:58m21s

My auth is valid for next 58 mins. My deploy/docer-compose.yml

version: '3.7'

services:
  terraform:
    image: hashicorp/terraform:0.12.21
    volumes:
      - .:/infra
    working_dir: /infra
    environment:
      - AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}
      - AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}
      - AWS_SESSION_TOKEN=${AWS_SESSION_TOKEN}

What is wrong?

Account policies enter image description here

amazon-web-services
1 Answers

Some things won't work with aws-vault's temporary credentials. Try to use the exec command and pass the parameter --no-session to use the original credentials:

aws-vault exec brankovich --no-session -- docker-compose -f deploy/docker-compose.yml run --rm terraform init
user_145772030
Related