{"action":"created","issue":{"url":"https://api.github.com/repos/hashicorp/terraform/issues/6523","repository_url":"https://api.github.com/repos/hashicorp/terraform","labels_url":"https://api.github.com/repos/hashicorp/terraform/issues/6523/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/terraform/issues/6523/comments","events_url":"https://api.github.com/repos/hashicorp/terraform/issues/6523/events","html_url":"https://github.com/hashicorp/terraform/issues/6523","id":153491332,"number":6523,"title":"Terraform fails to authenticate using STS temporary credentials - InvalidClientTokenId","user":{"login":"cabarria","id":18726993,"avatar_url":"https://avatars.githubusercontent.com/u/18726993?v=3","gravatar_id":"","url":"https://api.github.com/users/cabarria","html_url":"https://github.com/cabarria","followers_url":"https://api.github.com/users/cabarria/followers","following_url":"https://api.github.com/users/cabarria/following{/other_user}","gists_url":"https://api.github.com/users/cabarria/gists{/gist_id}","starred_url":"https://api.github.com/users/cabarria/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cabarria/subscriptions","organizations_url":"https://api.github.com/users/cabarria/orgs","repos_url":"https://api.github.com/users/cabarria/repos","events_url":"https://api.github.com/users/cabarria/events{/privacy}","received_events_url":"https://api.github.com/users/cabarria/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-05-06T16:43:28Z","updated_at":"2016-05-06T18:58:03Z","closed_at":null,"body":"I'm running Terraform v0.6.15. I have exported the following keys following an STS call for credentials:\r\nAWS_ACCESS_KEY_ID\r\nAWS_SECRET_ACCESS_KEY\r\nAWS_SESSION_TOKEN (Can use AWS_SECURITY_TOKEN as well)\r\n\r\nthe aws-cli works, but Terraform complains with the following:\r\n\r\nRefreshing Terraform state prior to plan...\r\n\r\nError refreshing state: 1 error(s) occurred:\r\n\r\n1 error(s) occurred:\r\n\r\nInvalidClientTokenId: The security token included in the request is invalid\r\nstatus code: 403, request id:\r\n\r\nNo matter what I do... I've tried AWS_TOKEN as the key as well, Terraform fails to use temporary credentials. If I use a Permanent Access Key and Secret Access Key it works. I thought this issue had been solved."},"comment":{"url":"https://api.github.com/repos/hashicorp/terraform/issues/comments/217529449","html_url":"https://github.com/hashicorp/terraform/issues/6523#issuecomment-217529449","issue_url":"https://api.github.com/repos/hashicorp/terraform/issues/6523","id":217529449,"user":{"login":"cabarria","id":18726993,"avatar_url":"https://avatars.githubusercontent.com/u/18726993?v=3","gravatar_id":"","url":"https://api.github.com/users/cabarria","html_url":"https://github.com/cabarria","followers_url":"https://api.github.com/users/cabarria/followers","following_url":"https://api.github.com/users/cabarria/following{/other_user}","gists_url":"https://api.github.com/users/cabarria/gists{/gist_id}","starred_url":"https://api.github.com/users/cabarria/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cabarria/subscriptions","organizations_url":"https://api.github.com/users/cabarria/orgs","repos_url":"https://api.github.com/users/cabarria/repos","events_url":"https://api.github.com/users/cabarria/events{/privacy}","received_events_url":"https://api.github.com/users/cabarria/received_events","type":"User","site_admin":false},"created_at":"2016-05-06T18:58:03Z","updated_at":"2016-05-06T18:58:03Z","body":"Looks like this is failing because the temporary credentials are being requested using the GetFederationToken API. http://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html\r\n\r\nThose temporary credentials are not allowed to make IAM API or STS calls. There must be some code in Terraform checking for that regardless of whether the user intends to work with IAM or not.\r\n\r\nI think this should be fixed... Terraform shouldn't presume to know that the credentials provided are not adequate to perform whatever actions the user needs."}}