为什么 Aws-vault 身份验证失败？ 使用凭据获取帐户 ID 时出错：调用 sts:GetCallerIdentity: InvalidClientTokenId 时出错

Question

I am using aws-vault to store my credenitals After running

docker-compose -f deploy/docker-compose.yml run --rm terraform init

I got error

Initializing the backend...

Error: error using credentials to get account ID: error calling sts:GetCallerIdentity: InvalidClientTokenId: The security token included in the request is invalid
    status code: 403, request id: 6ee874fd-9f27-4923-a6ac-b605ae49879d

I checked again

aws-vault list

shows

brankovich                brankovich                sts.GetSessionToken:58m21s

My auth is valid for next 58 mins. My deploy/docer-compose.yml

version: '3.7'

services:
  terraform:
    image: hashicorp/terraform:0.12.21
    volumes:
      - .:/infra
    working_dir: /infra
    environment:
      - AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}
      - AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}
      - AWS_SESSION_TOKEN=${AWS_SESSION_TOKEN}

What is wrong?

Account policies

Answer 1

Some things won't work with aws-vault's temporary credentials. Try to use the exec command and pass the parameter --no-session to use the original credentials:

aws-vault exec brankovich --no-session -- docker-compose -f deploy/docker-compose.yml run --rm terraform init