AWS CDK "The security token included in the request is invalid" in CI

By Kaveh Alemi·Latchkey

CDK called an AWS API and STS/IAM rejected the credential set as invalid. The token is malformed, expired, revoked, or belongs to a different partition than the region you target.

What this error means

cdk deploy or cdk synth fails with "The security token included in the request is invalid" or "InvalidClientTokenId" while contacting CloudFormation or STS.

❌  Deployment failed: Error: The security token included in the request is invalid.
    ... InvalidClientTokenId: The security token included in the request is invalid.

Common causes

Expired or temporary credentials

Short-lived STS credentials (from OIDC or assume-role) expired before deploy finished, so subsequent calls are rejected.

Wrong or stale access key

A deactivated or mistyped AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, or a missing AWS_SESSION_TOKEN for temporary keys, produces an invalid token.

How to fix it

Re-acquire fresh credentials

1. Use the configure-aws-credentials action so OIDC mints fresh short-lived keys per run.
2. Ensure AWS_SESSION_TOKEN is set whenever the keys are temporary.
3. Re-run; the new token is valid for the job duration.

- uses: aws-actions/configure-aws-credentials@v4
  with:
    role-to-assume: arn:aws:iam::123456789012:role/gha-deployer
    aws-region: us-east-1

Verify the identity before deploy

Call STS to confirm credentials resolve before CDK runs.

aws sts get-caller-identity

How to prevent it

• Prefer OIDC short-lived credentials over long-lived access keys.
• Always pass the session token with temporary credentials.
• Keep deploys short so STS sessions do not expire mid-run.

Frequently asked questions

Related guides

References

• Terraform documentation
• GitHub Actions documentation