Packer amazon-ebs "AuthFailure" in CI

By Kaveh Alemi·Latchkey

AuthFailure means AWS got the request and the credentials, but rejected them. Unlike a missing-credentials error, the SDK found keys; they are simply invalid, expired, or not valid for the region.

What this error means

packer build fails with "AuthFailure: AWS was not able to validate the provided access credentials" while describing images or launching the builder instance.

Error: Error querying AMI: AuthFailure: AWS was not able to validate the provided
access credentials
	status code: 401, request id: 1a2b3c4d-...

Common causes

Wrong or expired credentials

A stale secret, a rotated key, or expired OIDC session credentials get rejected with AuthFailure.

Clock skew on the runner

A signed request depends on time. A badly skewed runner clock makes AWS reject the signature.

How to fix it

Refresh the credentials

1. Re-run the OIDC credential step so temporary credentials are current.
2. If using keys, confirm the secret holds an active, non-rotated key pair.
3. Set the correct region for the account.

- uses: aws-actions/configure-aws-credentials@v4
  with:
    role-to-assume: arn:aws:iam::111122223333:role/packer-build
    aws-region: us-east-1

Fix runner clock skew

If AuthFailure appears intermittently, ensure the runner clock is synced so request signatures stay valid.

How to prevent it

• Use short-lived OIDC credentials rather than long-lived keys.
• Rotate and update key secrets in one place when they change.
• Keep the runner clock synchronized.

Frequently asked questions

Related guides

References

• Terraform documentation
• GitHub Actions documentation