The deployment could not read the STS caller identity

WHAT IT MEANS

The wrapper is not the root cause

Error: reading STS Caller Identity
operation error STS: GetCallerIdentity, https response error StatusCode: 403, api error SignatureDoesNotMatch: Credential should be scoped to a valid region.

The useful evidence is the nested STS status, endpoint, Region, and error code. Endpoint selection, signing, network routing, profile selection, or a credential source can fail before the deployment can identify its caller. This line alone does not prove a missing permission.

NEXT CHECK

Reproduce the identity check in the same environment

1. Read the nested cause. Preserve the HTTP status, STS endpoint, Region, profile or role, and signing error from the complete log block.
2. Run the read-only identity check. Use the same environment and credential source with aws sts get-caller-identity --region <region> and confirm which account and role the request reaches.
3. Fix the mismatch shown by the cause. Correct the endpoint, Region, signing, network, profile, or credential source; do not add an IAM allow for sts:GetCallerIdentity just because this wrapper appeared.

AUTOMATE THE TRIAGE

Keep the check in your normal workflow

SAM Doctor recognizes the Error: reading STS Caller Identity wrapper with low confidence and keeps the advice investigative. Runs locally; no AWS access, no log upload.

python -m pip install sam-doctor
sam-doctor diagnose deployment.log --format markdown

RELATED

Related errors

• Expired AWS credentials - the specific path when the nested error says the temporary token expired.
• Invalid AWS security token - credentials rejected before the caller can be identified.
• Unknown AWS service - an endpoint cannot route the request to a known service target.