Troubleshoot logging in using console credentials for the AWS CLI

The following provides troubleshooting advice for errors and issues that you might encounter logging in for AWS local development using console credentials for the AWS CLI. This doesn't include issues you may come across when using the AWS CLI. For more information, see Troubleshooting errors for the AWS CLI.

Issue: Firewall blocks network access when running "aws login"

When running aws login you may encounter a popup or message from your firewall software that prevents the AWS CLI from accessing your network.

Possible cause: Your firewall or security software is preventing the AWS CLI from opening the port used to handle the OAuth callback.

To avoid this issue, use the --remote option instead. This will prompt you to copy and paste the authorization code instead of using the OAuth callback.

$ aws login --remote

Issue: We were unable to complete your request

When running aws login, you might successfully open a new browser to access AWS, but the new page does not allow you to choose a session. Instead, the page says you were unable to complete your request. This might happen for the following reasons:

• If you're using our new AWS experience, you may be using the wrong AWS Region. Use aws configure list to view the default Region associated with your AWS CLI command. If you don't know which AWS Region you need to use, see Regions for AWS accounts.

• If you're using our new AWS experience, and someone has shared a project with you, you may have lost access to that project. Contact the project owner for more information.

• Your access to a specific AWS Region may be blocked. Contact your system administrator for more information.

• Your access to AWS may be blocked. Contact your system administrator for more information.

Issue: ExpiredToken or AccessDeniedException errors after using "aws login"

When running an AWS CLI command after running aws login for a given profile, you may encounter an expired or invalid credentials error.

$ aws s3 ls

An error occurred (ExpiredToken) when calling the ListBuckets operation: The provided token has expired.

Possible cause: You may have a mix of existing credentials and the new login credentials in that profile.

Run aws configure list or aws configure list --profile <profile-name> to print where the CLI is resolving credentials from for either the default or the given profile.

If the TYPE column is something other than login, this means that there is still a different type of credentials set in the target profile.

In this example, credentials are being resolved from the shared credentials file in your home directory, which has precedence over the login credentials.

$  aws configure list
NAME       : VALUE                    : TYPE             : LOCATION
profile    : <not set>                : None             : None
access_key : ****************MPLE     : shared-credentials-file :
secret_key : ****************EKEY     : shared-credentials-file :
region     : us-east-1                : config-file      : ~/.aws/config

To address this, manually remove any existing credentials from your config and credentials file for the target profile. Once you do so, you should see login credentials when running aws configure list again.

$  aws configure list
NAME       : VALUE                    : TYPE             : LOCATION
profile    : <not set>                : None             : None
access_key : ****************MPLE     : login            :
secret_key : ****************EKEY     : login            :
region     : us-east-1                : config-file      : ~/.aws/config

Alternatively using the --debug option will show where the CLI is resolving credentials from.