# CloudQuery sync error with AWS account due to invalid security token **URL:** \ **Category:** CloudQuery Plugins\ **Created:** [July 21, 2024, 3:25pm UTC](https://community.cloudquery.io/t/cloudquery-sync-error-with-aws-account-due-to-invalid-security-token/153 "2024-07-21T15:25:08Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![thorough-bear](https://avatars.discourse-cdn.com/v4/letter/t/f08c70/32.png) [@thorough-bear](https://community.cloudquery.io/u/thorough-bear)\ **Post date:** [July 21, 2024, 3:25pm UTC](https://community.cloudquery.io/t/cloudquery-sync-error-with-aws-account-due-to-invalid-security-token/153/1 "2024-07-21T15:25:08Z")
Hey CQ Team! I’m asking about an old version of AWS source: `v22.5.1`. This might be a specific AWS configuration, but maybe someone can help. I’m running CloudQuery locally on 2 AWS accounts. Before each run, I do `export` with different environment variables for `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and `AWS_SESSION_TOKEN` relevant for each account. In one account, the sync is fine. On the other account, I see the following error: ```auto failed to sync v3 source my_source: rpc error: code = Internal desc = failed to init plugin: failed to initialize client: operation error STS: GetCallerIdentity, https response error StatusCode: 403, RequestID: aa8d8669-5d23-4f37-983e-801c18bae6f2, api error InvalidClientTokenId: The security token included in the request is invalid ``` Can anyone point me to what might be the problem? BTW - when running with the problematic account and the same environment variables using the AWS CLI command `aws sts get-caller-identity`, the request is okay and there is no problem. Thank you! ---
**Author:** ![ben](https://sea1.discourse-cdn.com/flex001/user_avatar/community.cloudquery.io/ben/32/88_2.png) [@ben](https://community.cloudquery.io/u/ben)\ **Post date:** [July 21, 2024, 11:48pm UTC](https://community.cloudquery.io/t/cloudquery-sync-error-with-aws-account-due-to-invalid-security-token/153/2 "2024-07-21T23:48:40Z")
Does this error happen every time? Is it possible that the session token had expired? ---
**Author:** ![thorough-bear](https://avatars.discourse-cdn.com/v4/letter/t/f08c70/32.png) [@thorough-bear](https://community.cloudquery.io/u/thorough-bear)\ **Post date:** [July 22, 2024, 7:44am UTC](https://community.cloudquery.io/t/cloudquery-sync-error-with-aws-account-due-to-invalid-security-token/153/3 "2024-07-22T07:44:15Z")
Hey Ben! This happens every time on this specific account. I don’t think it’s possible that the Session Token had expired as I generated it a moment before running the sync. And as I said, when running the AWS CLI command ```auto aws sts get-caller-identity ``` it succeeds with no error. Might be some kind of configuration on this AWS Account? But it’s weird as the AWS CLI command does succeed 🧐 I don’t have access to this account; I only have a role which I assume and create this Session Token. **UPDATE:** I upgraded to the latest CQ CLI and latest AWS Source plugin - still the same problem. **UPDATE 2:** I found out that when CQ performs the `STS:GetCallerIdentity` on Account2 it uses the region `af-south-1` as it is enabled (and first in the sorting), and for Account1, it uses a different region. Now my problem is figuring out why I can’t communicate with this region… ---
**Author:** ![ben](https://sea1.discourse-cdn.com/flex001/user_avatar/community.cloudquery.io/ben/32/88_2.png) [@ben](https://community.cloudquery.io/u/ben)\ **Post date:** [July 22, 2024, 3:32pm UTC](https://community.cloudquery.io/t/cloudquery-sync-error-with-aws-account-due-to-invalid-security-token/153/4 "2024-07-22T15:32:23Z")
During initialization, we call `GetCallerIdentity` to understand which partition you are running in. We assume that we can call `GetCallerIdentity` from any of the valid regions that are being synced. I am assuming you are not specifying a list of regions to sync or are using `regions: ["*"]`. To avoid making the call to `af-south-1`, I would suggest specifying the exact list of regions you want to sync from. ---
**Author:** ![thorough-bear](https://avatars.discourse-cdn.com/v4/letter/t/f08c70/32.png) [@thorough-bear](https://community.cloudquery.io/u/thorough-bear)\ **Post date:** [July 22, 2024, 4:39pm UTC](https://community.cloudquery.io/t/cloudquery-sync-error-with-aws-account-due-to-invalid-security-token/153/5 "2024-07-22T16:39:53Z")
Hey! I just figured it out! CQ tries to `GetCallerIdentity` on region `af-south-1` but fails because in my account (the one that was used to generate the token), this region was disabled. After enabling it - it works! ---
**Author:** ![ben](https://sea1.discourse-cdn.com/flex001/user_avatar/community.cloudquery.io/ben/32/88_2.png) [@ben](https://community.cloudquery.io/u/ben)\ **Post date:** [July 22, 2024, 4:42pm UTC](https://community.cloudquery.io/t/cloudquery-sync-error-with-aws-account-due-to-invalid-security-token/153/6 "2024-07-22T16:42:48Z")
Great! Thank you for closing the loop on this! ---
**Author:** ![thorough-bear](https://avatars.discourse-cdn.com/v4/letter/t/f08c70/32.png) [@thorough-bear](https://community.cloudquery.io/u/thorough-bear)\ **Post date:** [July 22, 2024, 4:50pm UTC](https://community.cloudquery.io/t/cloudquery-sync-error-with-aws-account-due-to-invalid-security-token/153/7 "2024-07-22T16:50:24Z")
Another thing - the generated STS SecretToken must be generated according to the region that CQ is trying to do `GetCallIdentity` from.