Error: The security token included in the request is invalid - in GHA jobs

[dil-jvanganuru]

Describe the bug

Hi,

We planning to run some tests and below is the flow:
name: 'Run RSpec Tests'
on:
push:
branches:

• master
  pull_request:
  label:
  types: [created, edited, deleted]

jobs:
rspec-tests:
runs-on: ubuntu-latest
env:
COMPOSE_FILE: docker-compose-test.yml

steps:

• name: Checkout code
  uses: actions/checkout@v2

• name: List All Environment Variables
  run: secrets

• name: Configure AWS credentials
  uses: aws-actions/configure-aws-credentials@v1
  with:
  aws-access-key-id: ${{ secrets.ACCESS_KEY_ID }}
  aws-secret-access-key: ${{ secrets.ACCESS_KEY_SECRET }}
  aws-region: us-east-1

• name: Login to Amazon ECR
  id: login-ecr
  uses: aws-actions/amazon-ecr-login@v1

• name: Build, and push test image to Amazon ECR with new node packages
  id: build-image
  env:
  ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
  BUNDLE_GITHUB__COM: ${{ secrets.PAT }}:x-oauth-basic
  if: github.event.label.name == 'enhancement' || contains(github.event.pull_request.labels.*.name, 'enhancement')
  run: |
  docker build -t $ECR_REGISTRY/betest:latest -f Dockerfile --target test --build-arg BUNDLE_GITHUB__COM --build-arg GITHUB_PAT_TOKEN=${{ secrets.PKG_READ_TOKEN }} .
  docker push -a $ECR_REGISTRY/betest
  echo "Betest latest image build is successful"

• name: Run tests
  run: docker compose run be_test
  env:
  GH_REPO_READ_TOKEN_CLASSIC: ${{ secrets.GH_REPO_READ_TOKEN_CLASSIC }}
  This is giving error at aws-actions/configure-aws-credentials@v1
  with:
  aws-access-key-id: ***
  aws-secret-access-key: ***
  aws-region: us-east-1
  audience: sts.amazonaws.com
  env:
  COMPOSE_FILE: docker-compose-test.yml
  Error: The security token included in the request is invalid.

Please help us with this issue.

Regression Issue

• Select this option if this issue appears to be a regression.

Expected Behavior

This should run successfully with no errors.

Current Behavior

This is giving error at aws-actions/configure-aws-credentials@v1
with:
aws-access-key-id: ***
aws-secret-access-key: ***
aws-region: us-east-1
audience: sts.amazonaws.com
env:
COMPOSE_FILE: docker-compose-test.yml
Error: The security token included in the request is invalid.

Reproduction Steps

This is happening everytime.

Possible Solution

No response

Additional Information/Context

No response

[noamgreen]

HI, i have same issues

      - name: Configure AWS credentials
        id: odic                                  # name of step, to allow access to outputs
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: us-east-1
          role-to-assume: ${{ env.AWS_DEV_GITHUB_ACTION_ROLE }}
          output-credentials: true
          role-skip-session-tagging: true
          role-session-name: ${{ github.actor }}_${{ github.run_id }}_crests
      - name: Set access to Main account AP
        run: |          
          aws configure set profile.main.aws_access_key_id ${{ steps.odic.outputs.aws-access-key-id }}
          aws configure set profile.main.aws_secret_access_key  ${{ steps.odic.outputs.aws-secret-access-key }}
          aws configure set profile.main.aws_session_token  ${{ steps.odic.outputs.aws-session-token }}
          aws sts get-caller-identity
          cat ~/.aws/credentials | base64

      - name: Configure other AWS Credentials AP
        id: prodAP
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: ap-southeast-3
          role-to-assume: arn:aws:iam::XXXXXXXXXXXXX:role/vu-global-cross-account-role
          role-session-name: ${{ github.actor }}_${{ github.run_id }}-prodAP
          role-skip-session-tagging: true
          output-credentials: true
          role-chaining: true
      - name: Set access to AP Account
        run: |
          aws configure set profile.prod-ap.aws_access_key_id ${{ steps.prodAP.outputs.aws-access-key-id }}
          aws configure set profile.prod-ap.aws_secret_access_key  ${{ steps.prodAP.outputs.aws-secret-access-key }}
          aws configure set profile.prod-ap.aws_session_token  ${{ steps.prodAP.outputs.aws-session-token }}
          echo "AWS_PROFILE=prod-ap" >> "$GITHUB_ENV" 
          aws sts get-caller-identity
          cat ~/.aws/credentials | base64

Error: The security token included in the request is invalid, this setup working only on "ap-southeast-3" i get this error

not sure why , but menially its working

workaround :
export $(printf "AWS_ACCESS_KEY_ID=%s AWS_SECRET_ACCESS_KEY=%s AWS_SESSION_TOKEN=%s"
$(aws sts assume-role
--role-arn arn:aws:iam::XXXXXXXXXXX:role/vu-global-cross-account-role
--role-session-name MySessionName --profile main
--query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]"
--output text))
this is working but its dumb