Error Validating Credentials for AWS Cluster: "InvalidClientTokenId: The security token included in the request is invalid"

Problem

Operations related to a cluster associated with an AWS-based cloud provider are failing with an error similar to the following.

Command failed: /opt/pf9/qbert/bin/terraform apply -auto-approve=true -refresh=true -state=/mnt/mysqlfs/qbert/cloud/aws/5fa93981-d3cc-4d57-a059-ba0cddf24996.tfstate -var-file=/mnt/mysqlfs/qbert/cloud/aws/5fa93981-d3cc-4d57-a059-ba0cddf24996.tfvars.json -no-color -input=false

Error: error configuring Terraform AWS Provider: error validating provider credentials: error calling sts:GetCallerIdentity: InvalidClientTokenId: The security token included in the request is invalid.

status code: 403, request id: e95ce36c-d1e7-419c-ac8b-8fb22fca86b8

Environment

  • Platform9 Managed Kubernetes – All Versions

  • Qbert

  • AWS

Cause

Your AWS credentials have been rotated or otherwise revoked.

Known Bug

Note: A known bug exists in Platform9 v5.3, v5.4 whereas values aren't propagated to the Terraform configuration which Qbert relies upon in order to reconcile the desired state of the cluster with the resources in AWS. A fix is included in Platform9 Managed Kubernetes v5.5 and Higher.

For customers on an affected version, please submit a support request and our team will reach back out with the required next steps.

Resolution

  1. Manage your access keys to validate if your key exists, and whether it has been rotated. (Create a new access key if necessary.)

  2. Navigate to the PF9 UI > Infrastructure > Cloud Providers.

  3. Select your cloud provider, and click on "Edit".

  4. Enter a new Secret Access Key .

  5. Click "Update Cloud Provider".



© 2025 Platform9. All Rights Reserved

On This Page
Error Validating Credentials for AWS Cluster: "InvalidClientTokenId: The security token included in the request is invalid"ProblemEnvironmentCauseResolution