<p>I am using, terraform &amp; kubectl to deploy insfra-structure and application. </p>

<p>Since I changed aws configure : </p>

<p><code>terraform init</code></p>

<p><code>terraform apply</code> </p>

<p>I always got : </p>

<pre><code>terraform apply

Error: error validating provider credentials: error calling sts:GetCallerIdentity: InvalidClientTokenId: The security token included in the request is invalid.
    status code: 403, request id: 5ba38c31-d39a-11e9-a642-21e0b5cf5c0e

  on providers.tf line 1, in provider "aws":
   1: provider "aws" {
</code></pre>

<p>Can you advise ? Appreciate ! </p>

<p>From <a href="https://stackoverflow.com/questions/50121871/invalidclienttokenid-error-when-running-terraform-plan-apply/59314272#59314272">here</a>.</p>

<p>This is a general error that can be cause by a few reasons.</p>

<p>Some examples:</p>

<p>1)  Invalid credentials passed as environment variables or in <code>~/.aws/credentials</code>.</p>

<p><em>Solution: Remove old profiles / credentials  and clean all your environment vars</em>: </p>

<pre><code>for var in AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN AWS_SECURITY_TOKEN ; do eval unset $var ; done
</code></pre>

<p><br>
2) When your <code>aws_secret_access_key</code> contains characters like the plus-sign <code>+</code> or multiple forward-slash <code>/</code>. See more in <a href="https://github.com/hashicorp/terraform/issues/2972" rel="noreferrer">here</a>. <br>
<em>Solution:  Delete credentials and generate new ones.</em></p>

<p><br>
3) When you try to execute Terraform inside a region which must be explicitly enabled (and wasn't). <br>
(In my case it was <code>me-south-1 (Bahrain)</code> - See more in <a href="https://github.com/terraform-providers/terraform-provider-aws/blob/master/CHANGELOG.md#2220-august-01-2019" rel="noreferrer">here</a>).<br>
<em>Solution: Enable region or move to an enabled one.</em></p>

<p><br>
4) In cases where you work with 3rd party tools like <a href="https://www.vaultproject.io/" rel="noreferrer">Vault</a> and don't supply valid AWS credentials to communicate with - See more in <a href="https://groups.google.com/forum/#!topic/vault-tool/6mpSUpu61zo" rel="noreferrer">here</a>.</p>

<p><br>
<strong>All will lead to a failure of aws <code>sts:GetCallerIdentity</code> API.</strong></p>
