Help with Error in a function call; "get_aws_account_id" failed: InvalidClientTokenId on MacBook

[devPHub]

I have a Terragrunt project which is fully functioning on a Windows laptop. I switched to a new MacBook M3 Pro recently. I have the same version of Terraform and Terragrunt but running terragrunt init on the same project throws the following error.

Error in function call; Call to function "get_aws_account_id" failed: InvalidClientTokenId: The security token included in the request is invalid. ERRO[0000] Unable to determine underlying exit code, so Terragrunt will exit with error code 1

I am 100% sure that I have correct credentials on ~/.aws/credentials file. Tried to upgrade terraform/terragrunt to the latest but still failed. Could you please help me.

Additional info:
On Window (Working as expected)

Terraform v1.6.4
on windows_amd64

terragrunt version v0.53.5

On Macbook Pro M3 Max (Not working)

Terraform v1.6.4
on darwin_arm64

terragrunt version v0.53.5

AWS credentials - I am using AWS Identity center and the credential file contains the refreshed token in the below format.
~/.aws/credentials

[accountid_AWSAdministratorAccess]
aws_access_key_id=
aws_secret_access_key=
aws_session_token=

~/.aws/config

[accountid_AWSAdministratorAccess]
region = us-east-1
output = json

Terraform and Terragrunt are installed on Macbook using Homebrew. Tried with tfenv and tgenv to install the version I desired.

---

Tracked in ticket #110953

[yhakbar]

Hey,

Have you tried other versions of Terraform or OpenTofu? It looks like the subsequent release of Terraform addresses an issue related to what you're experiencing.

Also, how are you checking to see that your credentials are valid? Could you run the command aws sts get-caller-identity using the AWS CLI to confirm that the credentials work?

[devPHub]

@yhakbar Thank you very much for your response.
As you suggested, I upgraded the terraform version from 1.6.4 -> 1.6.5. Unfortunately, that did not help.

Yes, I used aws sts get-caller-identity to confirm the credential on the file is correct.

Interestingly, even terragrunt version is also throwing the same error.

Error in function call; Call to function "get_aws_account_id" failed: InvalidClientTokenId: The security token included in the request is invalid. status code: 403, request id: 3dc8f743-8d22-4238-93c3-caeda36c1997. ERRO[0000] Unable to determine underlying exit code, so Terragrunt will exit with error code 1

[yhakbar]

Hmmm...

Seems like a similar issue was fixed in https://github.com/gruntwork-io/terragrunt/releases/tag/v0.54.13

Do you mind attempting to reproduce on the latest version of Terragrunt?

[devPHub]

You mean, both Terraform and Terragrunt to latest (for compatibility)?
I am surprised to see issue only in MacBook but not on Windows, though.

[denis256]

Hi,
can be more issues:

• AWS_PROFILE profile variable is not set to the right profile name

• aren't set permissions to AWS config files

~/.aws/credentials 
~/.aws/config

• can be defined not related AWS env variables which affect accessing AWS API, confirm that there are no "AWS' variables defined, unset if exists any

printenv | grep -i AWS
unset AWS_ACCESS_KEY_ID
unset AWS_SECRET_ACCESS_KEY
unset AWS_SESSION_TOKEN

Try to run Terragrunt with debug log level --terragrunt-log-level debug to get more insights into why it fails

https://terragrunt.gruntwork.io/docs/features/work-with-multiple-aws-accounts/