InvalidClientTokenId: The security token included in the request is invalid

[sandunsameera]

I'm tring to connect my aws console through teleport. as per https://goteleport.com/docs/enroll-resources/application-access/cloud-apis/aws-console/#step-44-access-aws-resources this documentation I followed all the steps but when I launch the app from teleport webui it says "Internal server error." And when I check the jounalctl logs where teleport service is running it says

`User Message: InvalidClientTokenId: The security token included in the request is invalid.
දෙසැ 03 14:16:53 sandun-HP-EliteBook-840-G8-Notebook-PC teleport[683479]: status code: 403, request id: 39d5cacc-93d5-4331-8d68-596bc7998987] app/connections_handler.go:688
දෙසැ 03 14:16:54 sandun-HP-EliteBook-840-G8-Notebook-PC teleport[683479]: 2024-12-03T14:16:54+05:30 WARN [APP:SERVI] Failed to serve request error:[
දෙසැ 03 14:16:54 sandun-HP-EliteBook-840-G8-Notebook-PC teleport[683479]: ERROR REPORT:
දෙසැ 03 14:16:54 sandun-HP-EliteBook-840-G8-Notebook-PC teleport[683479]: Original Error: *awserr.requestError InvalidClientTokenId: The security token included in the request is invalid.
දෙසැ 03 14:16:54 sandun-HP-EliteBook-840-G8-Notebook-PC teleport[683479]: status code: 403, request id: c37863e9-4301-4820-ac13-8ee4ef8b9df9

Please note the teleport service is running on my local machine and I have credentials exported in /etc/defaule/teleport file.`

[webvictim]

Did you configure the IAM policy on the AWS side as per the docs? https://goteleport.com/docs/enroll-resources/application-access/cloud-apis/aws-console/#step-14-configure-aws-iam

This error generally means that the credentials being used to make the STS token request in the first place (i.e. those in /etc/default/teleport) are incorrect. The Teleport app_service process is intended to be run on an AWS-based host so that it can make use of role-based permission assignments, rather than IAM user/password credentials.