LocalStack "The security token included in the request is invalid" (endpoint-url not set) in CI
This error usually means the SDK sent your dummy LocalStack credentials to the real AWS endpoint, which rejects them. The fix is to set the endpoint URL so requests target LocalStack, not aws.amazon.com.
What this error means
A call fails with "The security token included in the request is invalid" even though it works against LocalStack elsewhere - because the endpoint URL was omitted and the request went to real AWS.
An error occurred (InvalidClientTokenId) when calling the ListBuckets operation:
The security token included in the request is invalid.Common causes
The endpoint URL was not configured
Without an explicit endpoint URL, the SDK targets real AWS, which rejects the placeholder credentials meant for LocalStack.
Only some clients set the endpoint
One client sets the LocalStack endpoint while another does not, so the second silently talks to real AWS.
How to fix it
Set the endpoint URL for every client
Direct all AWS SDK clients at the LocalStack endpoint so no request reaches real AWS.
s3 = boto3.client("s3", endpoint_url="http://localhost:4566")
sqs = boto3.client("sqs", endpoint_url="http://localhost:4566")Use a central endpoint configuration
Set the endpoint once (for example via a shared factory or an env-driven config) so no client can miss it.
export AWS_ENDPOINT_URL=http://localhost:4566How to prevent it
- Configure the LocalStack endpoint URL for every AWS client.
- Centralize endpoint config so no client defaults to real AWS.
- Keep dummy credentials paired with the LocalStack endpoint.