Boto3 error: The AWS Access Key Id you provided does not exist in our records
I am currently trying to get access to Amazon S3 inside a virtual machine and download files like so:
s3 = boto3.resource('s3',
aws_access_key_id="xxxxxxxxxxx",
aws_secret_access_key="xxxxxxxxxxxxxxxxx")
s3client = boto3.client('s3')
bucket = s3.Bucket('bucketone')
for obj in bucket.objects.all():
s3client.download_file(bucket_name, obj.key, filename)
But I’m getting the error:
botocore.exceptions.ClientError: An error occurred (InvalidAccessKeyId) when calling the ListObjects operation: The AWS Access Key Id you provided does not exist in our records.
What could I be doing wrong? I checked my aws_access_key_id and aws_secret_access_key multiple times, but still getting the same error. The same code locally, but not on a virtual machine, actually works on a different computer as well. There is a reason why I’m hardcoding in the keys, as I have to.Boto3 users BEWARE TL;DR If you are using temporary credentials to connect to AWS services through Boto3, you MUST include a current aws_session_token as a parameter to your boto3.session.Session instance. import os import boto3 session = boto3.Session( aws_access_key_id=os.environ["AWS_ACCESS_KEY_ID"], aws_secret_access_key=os.environ["AWS_SECRET_ACCESS_KEY"], aws_session_token=os.environ["AWS_SESSION_TOKEN"], ) # Test it on a service (yours may be different) s3 = session.resource('s3') # Print out bucket names for bucket in s3.buckets.all(): print(bucket.name) Explanation This is a crucial piece of information when you are testing credentials in Boto3: The error you receive may say this, ClientError: An error occurred (InvalidAccessKeyId) when calling the ListBuckets operation: The AWS Access Key Id you provided does not exist in our records. but may mean you are missing an aws_session_token if you are using temporary credentials (in my case, role-based credentials). According to AWS documentation, these are the parameters available to a boto3.session.Session object, however, there is no indication or clarification when it comes to this behavior in Boto3: Parameters aws_access_key_id (string) -- AWS access key ID aws_secret_access_key (string) -- AWS secret access key aws_session_token (string) -- AWS temporary session token region_name (string) -- Default region when creating new connections botocore_session (botocore.session.Session) -- Use this Botocore session instead of creating a new default one. profile_name (string) -- The name of a profile to use. If not given, then the default profile is used. Regarding the aws_session_token Specifies an AWS session token used as part of the credentials to authenticate the user. A session token is required only if you manually specify temporary security credentials. Resources aws_session_token Common scenarios for roles: Users, applications, and services Boto3 Credentials Session Reference
Get this solution programmatically \u2014 free, no authentication.
curl https://depscope.dev/api/error/7fcdad593c65ea0717456beecf457cf286ea87f5dab1bd34aaf9d4c60cd02a4a