DynamoDB Local "The security token included in the request is invalid" in CI

By Kaveh Alemi·Latchkey

DynamoDB Local does not verify credentials, but the AWS SDK still requires some credentials to sign the request. With none configured, the request is rejected with "UnrecognizedClientException: The security token included in the request is invalid". Setting any dummy keys fixes it.

What this error means

An SDK call fails with "UnrecognizedClientException: The security token included in the request is invalid" against the local endpoint, even though the table exists.

UnrecognizedClientException: The security token included in the request is invalid.

Common causes

No AWS credentials are configured in the job

The SDK cannot sign the request because no access key or secret is present in the environment or profile.

A real credential chain resolved to an invalid token

The SDK picked up partial or expired credentials from the environment instead of the dummy ones intended for Local.

How to fix it

Set dummy credentials and a region

1. Export any non-empty access key and secret.
2. Set a region so the SDK can build the request.
3. Point all calls at the local endpoint.

env:
  AWS_ACCESS_KEY_ID: dummy
  AWS_SECRET_ACCESS_KEY: dummy
  AWS_DEFAULT_REGION: us-east-1

Always pass the local endpoint

Make sure calls go to DynamoDB Local, not real AWS, so the dummy token is accepted.

aws dynamodb list-tables --endpoint-url http://127.0.0.1:8000 --region us-east-1

How to prevent it

• Set dummy AWS credentials and a region for Local.
• Always pass --endpoint-url to avoid hitting real AWS.
• Avoid leaking real credentials into the test job env.

Frequently asked questions

Related guides

References

• GitHub Actions documentation