The error
The security token included in the request is invalid.AWS exception UnrecognizedClientException. The Wraps CLI reports it as ACCESS_KEY_INVALID.
Why this happens
AWS did not recognise the credential the request was signed with. In practice this most often means the SDK signed with something empty or partially resolved, rather than with a real key that happens to be wrong. An unset environment variable, a profile that does not exist, or a container role that never attached all land here.
- The credential chain resolved to an empty or partial credential.
- A named profile was requested that does not exist in the shared config file.
- An instance or container role was expected but never attached.
- The access key was deleted, or belongs to another account.
How to fix it
1. Ask AWS who it thinks you are
The fastest discriminator. A clean answer means credentials resolve and the problem is elsewhere. The same error means the chain is producing nothing usable.
aws sts get-caller-identity2. Check the profile actually exists
AWS_PROFILE pointing at a name that is not in the shared config file does not fail loudly. It fails here, several layers later.
aws configure list-profiles3. Confirm the role attached, in a container or on an instance
Task roles and instance profiles can be configured and still not be present at runtime. If the credential provider never returned anything, this is the error you see.
4. Provide credentials by whichever route you already use
SSO, IAM access keys, environment variables and an existing named profile are all supported, and Wraps does not rank them.
aws configure ssoaws sso loginaws configureexport AWS_PROFILE=<profile-name>
How to stop it recurring
Fail fast on an unresolved credential chain
Resolving the caller identity at startup turns a confusing send-time error into an obvious boot-time one.
Do not let a missing profile fall through silently
Validate that the profile named in configuration exists, rather than discovering it from a signature failure.
Common questions
What is the difference between UnrecognizedClientException and InvalidClientTokenId?
Different AWS services report the same underlying condition under different names. Both mean AWS could not resolve the credential the request was signed with, and both are fixed by getting a working credential in front of the SDK.
Why does this happen only in my container?
Usually because the task or instance role is not actually attached at runtime, so the credential chain resolves to nothing. Locally your shared config file was quietly covering for it.
Is this a permissions problem?
No. A permissions problem returns AccessDenied. This error means authentication never succeeded, so the policy was never consulted.
What Wraps does about this
The Wraps CLI maps UnrecognizedClientException to ACCESS_KEY_INVALID. It is deliberately not reported as credentials not found, because that error is reserved for the case where nothing was found at all and it sends you somewhere different. Wraps stores no AWS credentials of yours.