AWS Terraform: │ Error: error configuring Terraform AWS Provider: error validating provider credentials: error calling sts:GetCallerIdentity:

Question

Error: error configuring Terraform AWS Provider:

error validating provider credentials: error calling sts:GetCallerIdentity: operation error STS: GetCallerIdentity, https response error StatusCode: 403, RequestID: 95e52463-8cd7-038-b924-3a5d4ad6ef03, api error InvalidClientTokenId: The security token included in the request is invalid. with provider["registry.terraform.io/hashicorp/aws"], on provider.tf line 1, in provider "aws": 1: provider "aws" {

I have only two files.

1. instance.tf

resource "aws_instance" "web" {
  ami           = "ami-068257025f72f470d"
  instance_type = "t2.micro"
    
  tags = {
    Name = "instance_using_terraform"
  }
}

2. provider.tf

provider "aws" {
  region = "ap-east-1"
  access_key = "xxxx"
  secret_key = "xxxx/xxx+xxx"
}

Seabrooke

What is your TF code producing the error? – Navigate

@Navigate tf code is planned and init successfully – Seabrooke

any possibility for this issue, checked aws region and secret key, access key also. – Seabrooke

How is it planned successfully when you get this error? Without the code you are using to configure the provider it is very hard to provide any help. – Cytolysin

instance.tf : resource "aws_instance" "web" { ami = "ami-068257025f72f470d" instance_type = "t2.micro" tags = { Name = "instance_using_terraform" } } – Seabrooke

providers.tf :provider "aws" { region = "ap-east-1" access_key = "xxxxxxxxx" secret_key = "xxxx/xx+xxxxxxxxx" } – Seabrooke

So you have not defined the terraform or required_providers blocks anywhere? – Cytolysin

@MarkoE Thank you for the help ! No, I not declared any type of providers rather than providers. tf file. Now, Programme works well. – Seabrooke

Answer 1

May be Your passed AWS configure region is different from your terraform provider region e.g: us-east-1 in AWS configure, us-east-1a in terraform provider region.

Please change those regions to the same.

Bedpost

Daamn, thanks! in my case this was it. It's a surprisingly obscure error for a fairly simple error to happen. In my case it was because I was using us-west-3 instead of eu-west-3. So only 2 chars (one of them the same) was that was causing this. – Tailrace

In some cases it can happen when the AWS region is not enabled by default like eu-south-1 – Aluminize

Answer 2

In mycase this issue is because your system date/time is wrong.

Set Time for my centos8 OS through following command

timedatectl status timedatectl set-time HH:MM:SS

it will throw error saying "Failed to set time: NTP unit is active“. if you already have set NTP service on your machine"

Then use below command to configure NTP

sudo timedatectl set-local-rtc true

sudo timedatectl set-ntp false

sudo timedatectl set-time "yyyy-MM-dd hh:mm:ss"

timedatectl list-timezones

sudo timedatectl set-timezone Europe/Zagreb

sudo timedatectl set-ntp yes

Wherefore

Answer 3

In my test environment I was using the root users access and secret access key which did not work. After creating a dedicated user the error did not occur anymore.

In detail I did the following steps:

Created a user called terraform here Created a new group Administrators with attached permissions Administrator Access by following the wizard Copied access key and secret access key to ~/. aws /credentials aws access key =xxx aws secret access key=xxx Created ~/.aws/config [default] region=us-west-2

Firearm

Answer 4

Make sure to use the default region specified for your AWS IAM account

provider "aws" {
  region     = "eu-north-1" # < --- here 
  access_key = "**************"
  secret_key = "**************"
}

Undis

Answer 5

Check .aws folder(CONFIG FILE). Try this

aws sts get-caller-identity

{
    "UserId": "AIDAYMYFUCQM7K2RD9DDD",
    "Account": "111147549871",
    "Arn": "arn:aws:iam::111147549871:user/myself"
}

Also show us your main.tf file and where and how you define access.

Octaviooctavius

exactly i not userstood.... in the providers.tf file or other file need top change – Seabrooke

Try this from cli. – Octaviooctavius

Thank you for your help, I found the solution. – Seabrooke

Answer 6

Made mistake in the region where I declared entered the wrong namecode of region and access key - secret key '+' and '/' generating the error due to some symbols, you just need to try the new key till the access key contains only alphabetical string. (Symbols are lmao).

Seabrooke

Answer 7

For me, I had to update my provider version. Went through all the suggestions here, but none worked. My required_providers version was 4.67.0, but updating it to 5.0 on my .tf file required I update the locked dependency selections to match a changed configuration by running "terraform init -upgrade" command. And that did it for me.

Atalya

Answer 8

In case anyone comes across this issue, I found that the workspace I was working in had environment variables set in Terraform Cloud for the AWS credentials. These were taking precedence over my local credentials and needed to be refreshed.

Pratte

Answer 9

For anyone who might hit this error

Error: configuring Terraform AWS Provider: validating provider credentials: retrieving caller identity from STS: operation error STS: GetCallerIdentity, https response error StatusCode: 400 ... api error IncompleteSignature: ....  not a valid key=value pair  

Check that your credentials file doesn't contain any trailing spaces, eg at the end of lines. AWS is quite happy to strip these and works fine, Terraform doesn't! Took me way to long to track that one down.

Felton

Answer 10

In my case, I was demonstrating with the Credentials and files I downloaded from GitHub. I didn't change the credentials to my own. (Both the Access Key and the Secret Key). I changed it and it worked! I was on it for several weeks trying to figure what could have happened.

Engenia

Answer 11

In my case it was because I had disabled the regions in the account I was trying to generate a plan. To see the list of enabled/disabled regions, you can go here: https://us-east-1.console.aws.amazon.com/billing/home?region=us-east-1#/account?AWS-Regions

Kammerer

Answer 12

In my case we were using multiple provider blocks in multiple AWS regions with the same profile as this:

provider "aws" {
  alias   = "prod01"
  region  = "us-east-1"
  profile = "prod"
}

provider "aws" {
  alias   = "prod02"
  region  = "eu-central-1"
  profile = "prod"
}

The fix was to have two AWS profile mapped to each provider not just one.

For example you would have to configure two AWS profiles for each region using aws configure --profile <profile_name> twice, or saml2aws login --region us-east-1 --profile prod-us-east-1 and again saml2aws login --region eu-central-1 --profile prod-eu-central-1

then modify your terraform code to use the correct profile:

provider "aws" {
  alias   = "prod01"
  region  = "us-east-1"
  profile = "prod-us-east-1"
}

provider "aws" {
  alias   = "prod02"
  region  = "eu-central-1"
  profile = "prod-eu-central-1"
}

Flabbergast

Answer 13

Check your access key is active or not. If it is active and reconfigure using aws configure and change the region from default to ap-east-1

May this work!!

Gaga

Answer 14

Please create new user with full admin access and then click on application use outside ec2 instance. This may work in your case.

Laconia

Answer 15

I think is because of the zone you have put in your terraform script. I know that you can see the availability region in the EC2 console in AWS.

Ex

Answer 16

In my case, the error was because I didn't have a default configuration declaration. When I created it, it all worked.

Erotomania

Please elaborate what was missing and what was setup. – Saltwort