Invalid request: The security token included in the request is invalid. (Service: AWSSecurityTokenService; Status Code: 403; Error Code: InvalidClientTokenId; Request ID: 4f9fb8f1-a107-4ccf-b538-a4de826e9c30; Proxy: null

Harness Support
1

Hi,

I have created deployment pipeline and created deploy stage and trying push changes to AWS EC2. I have given AWS ARN key as well and when i am trying to push changes using Harness Platform and i am getting below error. please any advise
"Invalid request: The security token included in the request is invalid. (Service: AWSSecurityTokenService; Status Code: 403; Error Code: InvalidClientTokenId; Request ID: 4f9fb8f1-a107-4ccf-b538-a4de826e9c30; Proxy: null)
Issue could be

  • Access Key or Secret Key is invalid. User may not have required permissions to describe regions.
    Cross account role ARN or External Id is invalid or User / IAM Role on delegate / IRSA role doesn’t have permission to perform sts:AssumeRole.
    Assumed Cross account role may not have permissions to describe regions.
    Try these suggestions

  • Check if access key, secret key are valid.
    Check if user has required permissions to describe regions.
    Check if Cross account role ARN, External Id are valid.
    Check if User / IAM Role on delegate / IRSA role has permission to perform sts:AssumeRole.
    Check if assumed Cross account role has permissions to describe regions.
    Run this command to check the details about the IAM user/role: aws sts get-caller-identity

2

Hi @rpokuri , the error message suggests few of the possible reasons for the error, could you please check you have configured all things right as mentioned.
Issue could be

* Access Key or Secret Key is invalid. User may not have required permissions to describe regions.
* Cross account role ARN or External Id is invalid or User / IAM Role on delegate / IRSA role doesn’t have permission to perform sts:AssumeRole.
* Assumed Cross account role may not have permissions to describe regions.
* Try these suggestions
* Check if access key, secret key are valid.
* Check if user has required permissions to describe regions.
* Check if Cross account role ARN, External Id are valid.
* Check if User / IAM Role on delegate / IRSA role has permission to perform sts:AssumeRole.
* Check if assumed Cross account role has permissions to describe regions.
* Run this command to check the details about the IAM user/role: `aws sts get-caller-identity`