ERROR REFERENCE
The security token included in the request is invalid
AWS rejected the credentials outright — not expired, invalid.
The access key belongs to no known account
(UnrecognizedClientException), or the token was never
valid in this partition. Different failure from an expired session,
and waiting or refreshing will not fix it.
WHAT IT MEANS
What this error means
The usual causes, in rough order of frequency:
- stale
AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY/AWS_SESSION_TOKENenvironment variables silently overriding the profile you meant to use; - credentials for a different account than the one this deploy targets;
- a session token paired with the wrong access key (copy-paste from two different credential sets);
- a region or partition mismatch - GovCloud and China-region credentials do not work against commercial endpoints.
FIX
How to fix it
-
See which source supplied each credential value
(read-only):
Theaws configure listTypecolumn exposes the environment-variable override immediately. - Clear the stale environment variables (or set the correct ones) and re-run - in CI, check what an earlier auth step exported into the job environment.
-
Confirm the account once it works:
The account in the output should be the one the stack deploys into.aws sts get-caller-identity
AUTOMATE THE TRIAGE
Diagnose this automatically
SAM Doctor recognizes the invalid-token wording (high confidence) and keeps it distinct from expired credentials, which have their own rule and fix. Runs locally; no AWS access, no log upload.
python -m pip install sam-doctor
sam-doctor diagnose deployment.log --format markdownRELATED
Related errors
- The security token is expired — the once-valid variant with a different fix.
- Not authorized to perform: sts:AssumeRoleWithWebIdentity — when OIDC-minted credentials are the ones being rejected.