UnrecognizedClientException when creating a client with AWS Go SDK

Question

I'm trying to use SSM with Go AWS SDK. I have valid IAM User credentials stored in the credentials file. The file and the credentials are good because, it behaves as expected when

aws ssm start-session --target "instanceid"

But the problem is with Go SDK. I tried v1 and v2 both.

sdk v1

   mySession := session.Must(session.NewSession())
    svc := ssm.New(mySession, aws.NewConfig().WithRegion("ap-southeast-1"))
    out, err := svc.StartSession(&ssm.StartSessionInput{Target: aws.String(instanceId)})
    if err != nil {
        log.Fatalf("error starting ssm  : %v", err)
    }

and v2

   cfg, err := external.LoadDefaultAWSConfig()
    if err != nil {
        panic("unable to load SDK config, " + err.Error())
    }

    svc := ssm.New(cfg)

    req := svc.StartSessionRequest(&ssm.StartSessionInput{
        Target: aws.String(instanceId),
    })

    resp, _ := req.Send(context.Background())
    if err != nil {
        log.Fatalf("error sending ssm request : %v", err)
    }
    fmt.Println(resp)

give an error saying.

UnrecognizedClientException: The security token included in the request is invalid.

The credentials get loaded to the config objects also. I was wondering if its because I'm using IAM User credentials.

Are you using credentials in env variable? Use export AWS_PROFILE="default" also — Eklavya
I did an assume role and used that profile like you said. Now it works even without the environment variable set. echo $AWS_PROFILE return nothing. but it works. weird. — Rochana Atapattu
You have already credentials in a file like .aws/credentials for default may be. — Eklavya

Eklavya Eklavya · Accepted Answer · 2020-05-01T18:31:17

By default, the SDK detects AWS credentials set in your environment and uses them to sign requests to AWS. That way you don’t need to manage credentials in your applications.The SDK looks for credentials in the following environment variables:

$ export AWS_ACCESS_KEY_ID=YOUR_AKID
$ export AWS_SECRET_ACCESS_KEY=YOUR_SECRET_KEY

If you already have any profile you can use them also.

Find details here

UnrecognizedClientException when creating a client with AWS Go SDK

1 Answers