An error occurred (InvalidAccessKeyId) when calling the ListBuckets operation: The AWS Access Key Id you provided does not exist in our records.

Why it happens

The AWS CLI may be reading credentials from a different place than you expect, or the access key pair is wrong. A related message is InvalidClientTokenId: "The security token included in the request is invalid."

Where you see it, and what it affects

The AWS CLI prints this after a command such as aws s3 ls when AWS does not recognise the access key ID it was sent. In aws configure list output, the Type and Location columns show where each value came from, such as shared-credentials-file or an environment variable like AWS_DEFAULT_REGION.

How to fix it

1. 1

   Step 1

   In your shell, run aws configure list. It shows the access key in use and where it came from (for example the shared credentials file or an environment variable).

2. 2

   Step 2

   Check the config and credentials files, and any AWS_ environment variables, for old or mistyped keys.

3. 3

   Step 3

   If the keys are correct, check that your computer's clock is right, as AWS notes the clock may be out of sync. On Linux or macOS run date. On Windows use the date and time options in Control Panel.

aws configure list

Check that it is fixed

• aws configure list shows a masked access_key ending in the characters you expect, from the Location you expect.
• aws sts get-caller-identity returns your UserId, Account and Arn instead of an error.

Sources