LocalStack "InvalidClientTokenId" (need dummy AWS creds) in CI

By Kaveh Alemi·Latchkey

LocalStack accepts any credentials but the SDK must still send some. When no credentials are configured in CI, or a credential-validating call runs, you can get "InvalidClientTokenId". Setting placeholder keys like test/test fixes it.

What this error means

An AWS call against LocalStack fails with "An error occurred (InvalidClientTokenId) ... The security token included in the request is invalid" because no dummy credentials were provided.

LocalStack

botocore.exceptions.ClientError: An error occurred (InvalidClientTokenId) when calling the
GetCallerIdentity operation: The security token included in the request is invalid.

Common causes

No AWS credentials set in the CI environment

The runner has no AWS credentials at all, so the SDK cannot build a valid signed request even for LocalStack.

A validating operation with empty creds

Calls like sts get-caller-identity reject empty or malformed credentials, surfacing InvalidClientTokenId.

How to fix it

Set placeholder AWS credentials

Provide dummy access keys so the SDK signs requests; LocalStack does not verify them.

.github/workflows/ci.yml

env:
  AWS_ACCESS_KEY_ID: test
  AWS_SECRET_ACCESS_KEY: test
  AWS_DEFAULT_REGION: us-east-1

Point the client at LocalStack too

Combine the dummy credentials with the LocalStack endpoint URL so the request goes to LocalStack, not real AWS.

Terminal

aws --endpoint-url=http://localhost:4566 s3 ls

How to prevent it

Export dummy test/test credentials for LocalStack jobs.
Set a default region alongside the credentials.
Always pair dummy creds with the LocalStack endpoint URL.

Frequently asked questions

What causes ""InvalidClientTokenId""?