AWS InvalidClientTokenId Errors / Error: Skipping disabled region..

[Mike-OSPN]

Hi
I'm seeing the errors
Error: Skipping disabled region eu-west-2... (for any region)
and
/var/lib/gems/2.7.0/gems/aws-sdk-core-3.117.0/lib/seahorse/client/plugins/raise_response_errors.rb:17:in `call': The security token included in the request is invalid. (Aws::IAM::Errors::InvalidClientTokenId)
(entire output below)

1. Where/how can I enable/disable regions?
2. Regarding InvalidClientTokenId: I'm running the script two IAM users (one in the root/Cloudtrain account, one in the Lamba/"to bes scanned" account). Both IAM users have AdministratorAccess.

my .aws/credentials file looks like this:

[account_to_be_scanned]
aws_access_key_id = **to-be-scanned-account
aws_secret_access_key = ***to-be-scanned-account
region = eu-west-1

[root_account]
aws_access_key_id = ***root-account
aws_secret_access_key = ***root-account
region = eu-west-1

I'm exporting these variables:

export REGION=eu-west-1
export CSV_PATH="myexport.csv"
export BUCKET=my-cloudtrail-bucket
export BUCKET_REGION=eu-west-1
export SCAN_PROFILE=account_to_be_scanned
export LAMBDA_PROFILE=root_account
export LAMBDA_REGION=eu-west-1
export ACCESS_KEY_ID="*****to-be-scanned-account***"
export SECRET_ACCESS_KEY="******to-be-scanned-account***"

then invoking the script:

./retro_tag.rb \
  --csv "$CSV_PATH" \
  --bucket $BUCKET \
  --bucket-region $BUCKET_REGION \
  --scan-profile "$SCAN_PROFILE" \
  --lambda-profile "$LAMBDA_PROFILE" \
  --lambda-region $LAMBDA_REGION \
  --scan-access-key-id=ACCESS_KEY_ID \
  --scan-secret-access-key=SECRET_ACCESS_KEY

(note: without the last two options, its not running at all)

Here the entire output:

Importing from /home/it-services/RetroTag/retro-tag/myexport.csv (1.42 MiB)...completed in 0 seconds.
The AwsResource::VpnGateway.get_resources cache file is too old, scanning aws...
The AwsResource::VpnConnection.get_resources cache file is too old, scanning aws...
The AwsResource::VpcSubnet.get_resources cache file is too old, scanning aws...
The AwsResource::VpcRouteTable.get_resources cache file is too old, scanning aws...
The AwsResource::VpcPeering.get_resources cache file is too old, scanning aws...
The AwsResource::VpcNetworkAcl.get_resources cache file is too old, scanning aws...
The AwsResource::VpcNatGateway.get_resources cache file is too old, scanning aws...
The AwsResource::VpcInternetGateway.get_resources cache file is too old, scanning aws...
The AwsResource::VpcEni.get_resources cache file is too old, scanning aws...
The AwsResource::Vpc.get_resources cache file is too old, scanning aws...
Error: Skipping disabled region af-south-1...
Error: Skipping disabled region af-south-1...
Error: Skipping disabled region af-south-1...
Error: Skipping disabled region af-south-1...
Error: Skipping disabled region af-south-1...
Error: Skipping disabled region af-south-1...
Error: Skipping disabled region af-south-1...
Error: Skipping disabled region af-south-1...
Error: Skipping disabled region af-south-1...
Error: Skipping disabled region af-south-1...
Error: Skipping disabled region ap-east-1...
Error: Skipping disabled region ap-east-1...
Error: Skipping disabled region ap-east-1...
Error: Skipping disabled region ap-east-1...
Error: Skipping disabled region ap-east-1...
Error: Skipping disabled region ap-east-1...
Error: Skipping disabled region ap-east-1...
Error: Skipping disabled region ap-east-1...
Error: Skipping disabled region ap-east-1...
Error: Skipping disabled region ap-east-1...
Error: Skipping disabled region ap-northeast-1...
Error: Skipping disabled region ap-northeast-1...
Error: Skipping disabled region ap-northeast-1...
Error: Skipping disabled region ap-northeast-1...
Error: Skipping disabled region ap-northeast-1...
Error: Skipping disabled region ap-northeast-1...
Error: Skipping disabled region ap-northeast-1...
Error: Skipping disabled region ap-northeast-1...
Error: Skipping disabled region ap-northeast-1...
Error: Skipping disabled region ap-northeast-1...
Error: Skipping disabled region ap-northeast-2...
Error: Skipping disabled region ap-northeast-2...
Error: Skipping disabled region ap-northeast-2...
Error: Skipping disabled region ap-northeast-2...
Error: Skipping disabled region ap-northeast-2...
Error: Skipping disabled region ap-northeast-2...
Error: Skipping disabled region ap-northeast-2...
Error: Skipping disabled region ap-northeast-2...
Error: Skipping disabled region ap-northeast-2...
Error: Skipping disabled region ap-northeast-2...
Error: Skipping disabled region ap-northeast-3...
Error: Skipping disabled region ap-northeast-3...
Error: Skipping disabled region ap-northeast-3...
Error: Skipping disabled region ap-northeast-3...
Error: Skipping disabled region ap-northeast-3...
Error: Skipping disabled region ap-northeast-3...
Error: Skipping disabled region ap-northeast-3...
Error: Skipping disabled region ap-northeast-3...
Error: Skipping disabled region ap-northeast-3...
Error: Skipping disabled region ap-northeast-3...
Error: Skipping disabled region ap-south-1...
Error: Skipping disabled region ap-south-1...
Error: Skipping disabled region ap-south-1...
Error: Skipping disabled region ap-south-1...
Error: Skipping disabled region ap-south-1...
Error: Skipping disabled region ap-south-1...
Error: Skipping disabled region ap-south-1...
Error: Skipping disabled region ap-south-1...
Error: Skipping disabled region ap-south-1...
Error: Skipping disabled region ap-south-1...
Error: Skipping disabled region ap-southeast-1...
Error: Skipping disabled region ap-southeast-1...
Error: Skipping disabled region ap-southeast-1...
Error: Skipping disabled region ap-southeast-1...
Error: Skipping disabled region ap-southeast-1...
Error: Skipping disabled region ap-southeast-1...
Error: Skipping disabled region ap-southeast-1...
Error: Skipping disabled region ap-southeast-1...
Error: Skipping disabled region ap-southeast-1...
Error: Skipping disabled region ap-southeast-1...
Error: Skipping disabled region ap-southeast-2...
Error: Skipping disabled region ap-southeast-2...
Error: Skipping disabled region ap-southeast-2...
Error: Skipping disabled region ap-southeast-2...
Error: Skipping disabled region ap-southeast-2...
Error: Skipping disabled region ap-southeast-2...
Error: Skipping disabled region ap-southeast-2...
Error: Skipping disabled region ap-southeast-2...
Error: Skipping disabled region ap-southeast-2...
Error: Skipping disabled region ap-southeast-2...
Error: Skipping disabled region ca-central-1...
Error: Skipping disabled region ca-central-1...
Error: Skipping disabled region ca-central-1...
Error: Skipping disabled region ca-central-1...
Error: Skipping disabled region ca-central-1...
Error: Skipping disabled region ca-central-1...
Error: Skipping disabled region ca-central-1...
Error: Skipping disabled region ca-central-1...
Error: Skipping disabled region ca-central-1...
Error: Skipping disabled region ca-central-1...
Error: Skipping disabled region eu-central-1...
Error: Skipping disabled region eu-central-1...
Error: Skipping disabled region eu-central-1...
Error: Skipping disabled region eu-central-1...
Error: Skipping disabled region eu-central-1...
Error: Skipping disabled region eu-central-1...
Error: Skipping disabled region eu-central-1...
Error: Skipping disabled region eu-central-1...
Error: Skipping disabled region eu-central-1...
Error: Skipping disabled region eu-central-1...
Error: Skipping disabled region eu-north-1...
Error: Skipping disabled region eu-north-1...
Error: Skipping disabled region eu-north-1...
Error: Skipping disabled region eu-north-1...
Error: Skipping disabled region eu-north-1...
Error: Skipping disabled region eu-north-1...
Error: Skipping disabled region eu-north-1...
Error: Skipping disabled region eu-north-1...
Error: Skipping disabled region eu-north-1...
Error: Skipping disabled region eu-north-1...
Error: Skipping disabled region eu-south-1...
Error: Skipping disabled region eu-south-1...
Error: Skipping disabled region eu-south-1...
Error: Skipping disabled region eu-south-1...
Error: Skipping disabled region eu-south-1...
Error: Skipping disabled region eu-south-1...
Error: Skipping disabled region eu-south-1...
Error: Skipping disabled region eu-south-1...
Error: Skipping disabled region eu-south-1...
Error: Skipping disabled region eu-south-1...
Error: Skipping disabled region eu-west-1...
Error: Skipping disabled region eu-west-1...
Error: Skipping disabled region eu-west-1...
Error: Skipping disabled region eu-west-1...
Error: Skipping disabled region eu-west-1...
Error: Skipping disabled region eu-west-1...
Error: Skipping disabled region eu-west-1...
Error: Skipping disabled region eu-west-1...
Error: Skipping disabled region eu-west-1...
Error: Skipping disabled region eu-west-1...
Error: Skipping disabled region eu-west-2...
Error: Skipping disabled region eu-west-2...
Error: Skipping disabled region eu-west-2...
Error: Skipping disabled region eu-west-2...
Error: Skipping disabled region eu-west-2...
Error: Skipping disabled region eu-west-2...
Error: Skipping disabled region eu-west-2...
Error: Skipping disabled region eu-west-2...
Error: Skipping disabled region eu-west-2...
Error: Skipping disabled region eu-west-2...
Error: Skipping disabled region eu-west-3...
Error: Skipping disabled region eu-west-3...
Error: Skipping disabled region eu-west-3...
Error: Skipping disabled region eu-west-3...
Error: Skipping disabled region eu-west-3...
Error: Skipping disabled region eu-west-3...
Error: Skipping disabled region eu-west-3...
Error: Skipping disabled region eu-west-3...
Error: Skipping disabled region eu-west-3...
Error: Skipping disabled region eu-west-3...
Error: Skipping disabled region me-south-1...
Error: Skipping disabled region me-south-1...
Error: Skipping disabled region me-south-1...
Error: Skipping disabled region me-south-1...
Error: Skipping disabled region me-south-1...
Error: Skipping disabled region me-south-1...
Error: Skipping disabled region me-south-1...
Error: Skipping disabled region me-south-1...
Error: Skipping disabled region me-south-1...
Error: Skipping disabled region me-south-1...
Error: Skipping disabled region sa-east-1...
Error: Skipping disabled region sa-east-1...
Error: Skipping disabled region sa-east-1...
Error: Skipping disabled region sa-east-1...
Error: Skipping disabled region sa-east-1...
Error: Skipping disabled region sa-east-1...
Error: Skipping disabled region sa-east-1...
Error: Skipping disabled region sa-east-1...
Error: Skipping disabled region sa-east-1...
Error: Skipping disabled region sa-east-1...
Error: Skipping disabled region us-east-1...
Error: Skipping disabled region us-east-1...
Error: Skipping disabled region us-east-1...
Error: Skipping disabled region us-east-1...
Error: Skipping disabled region us-east-1...
Error: Skipping disabled region us-east-1...
Error: Skipping disabled region us-east-1...
Error: Skipping disabled region us-east-1...
Error: Skipping disabled region us-east-1...
Error: Skipping disabled region us-east-1...
Error: Skipping disabled region us-east-2...
Error: Skipping disabled region us-east-2...
Error: Skipping disabled region us-east-2...
Error: Skipping disabled region us-east-2...
Error: Skipping disabled region us-east-2...
Error: Skipping disabled region us-east-2...
Error: Skipping disabled region us-east-2...
Error: Skipping disabled region us-east-2...
Error: Skipping disabled region us-east-2...
Error: Skipping disabled region us-east-2...
Error: Skipping disabled region us-west-1...
Error: Skipping disabled region us-west-1...
Error: Skipping disabled region us-west-1...
Error: Skipping disabled region us-west-1...
Error: Skipping disabled region us-west-1...
Error: Skipping disabled region us-west-1...
Error: Skipping disabled region us-west-1...
Error: Skipping disabled region us-west-1...
Error: Skipping disabled region us-west-1...
Error: Skipping disabled region us-west-1...
Error: Skipping disabled region us-west-2...
Total AwsResource::VpcSubnet.get_resources: 0
The AwsResource::SecurityGroup.get_resources cache file is too old, scanning aws...
Error: Skipping disabled region us-west-2...
Total AwsResource::VpcInternetGateway.get_resources: 0
The AwsResource::S3Bucket.get_resources cache file is too old, scanning aws...
Error: Skipping disabled region us-west-2...
Total AwsResource::VpnGateway.get_resources: 0
Error: Skipping disabled region us-west-2...
Total AwsResource::VpcRouteTable.get_resources: 0
Error: Skipping disabled region us-west-2...
Total AwsResource::VpnConnection.get_resources: 0
The AwsResource::LambdaFunction.get_resources cache file is too old, scanning aws...
The AwsResource::OpsWorks.get_resources cache file is too old, scanning aws...
Error: Skipping disabled region us-west-2...
Total AwsResource::VpcEni.get_resources: 0
The AwsResource::IamRole.get_resources cache file is too old, scanning aws...
The AwsResource::Rds.get_resources cache file is too old, scanning aws...
Error: Skipping disabled region us-west-2...
Total AwsResource::VpcNetworkAcl.get_resources: 0
The AwsResource::IamUser.get_resources cache file is too old, scanning aws...
Error: Skipping disabled region us-west-2...
Total AwsResource::VpcNatGateway.get_resources: 0
Error: Skipping disabled region us-west-2...
Total AwsResource::Vpc.get_resources: 0
The AwsResource::ElasticLoadBalancingV2.get_resources cache file is too old, scanning aws...
The AwsResource::ElasticMapReduce.get_resources cache file is too old, scanning aws...
Error: Skipping disabled region us-west-2...
Total AwsResource::VpcPeering.get_resources: 0
The AwsResource::ElasticLoadBalancing.get_resources cache file is too old, scanning aws...
Error: Skipping disabled region us-east-1...
Total AwsResource::S3Bucket.get_resources: 0
The AwsResource::Eip.get_resources cache file is too old, scanning aws...
#<Thread:0x000055ea66c9c358 ./retro_tag.rb:162 run> terminated with exception (report_on_exception is true):
Traceback (most recent call last):
13: from ./retro_tag.rb:168:in `block (2 levels) in

'
12: from /home/it-services/RetroTag/retro-tag/auto_tag/aws_mixin.rb:19:in `write_cache_file'
11: from /home/it-services/RetroTag/retro-tag/aws_resource/default.rb:55:in `get_resources'
10: from /home/it-services/RetroTag/retro-tag/aws_resource/default.rb:55:in `each'
9: from /home/it-services/RetroTag/retro-tag/aws_resource/default.rb:61:in `block in get_resources'
8: from /var/lib/gems/2.7.0/gems/aws-sdk-iam-1.56.0/lib/aws-sdk-iam/client.rb:8226:in `list_roles'
7: from /var/lib/gems/2.7.0/gems/aws-sdk-core-3.117.0/lib/seahorse/client/request.rb:72:in `send_request'
6: from /var/lib/gems/2.7.0/gems/aws-sdk-core-3.117.0/lib/seahorse/client/plugins/response_target.rb:24:in `call'
5: from /var/lib/gems/2.7.0/gems/aws-sdk-core-3.117.0/lib/aws-sdk-core/plugins/response_paging.rb:12:in `call'
4: from /var/lib/gems/2.7.0/gems/aws-sdk-core-3.117.0/lib/seahorse/client/plugins/request_callback.rb:71:in `call'
3: from /var/lib/gems/2.7.0/gems/aws-sdk-core-3.117.0/lib/aws-sdk-core/plugins/param_converter.rb:26:in `call'
2: from /var/lib/gems/2.7.0/gems/aws-sdk-core-3.117.0/lib/aws-sdk-core/plugins/idempotency_token.rb:19:in `call'
1: from /var/lib/gems/2.7.0/gems/aws-sdk-core-3.117.0/lib/aws-sdk-core/plugins/jsonvalue_converter.rb:22:in `call'
/var/lib/gems/2.7.0/gems/aws-sdk-core-3.117.0/lib/seahorse/client/plugins/raise_response_errors.rb:17:in `call': The security token included in the request is invalid. (Aws::IAM::Errors::InvalidClientTokenId)
#<Thread:0x000055ea66c9c038 ./retro_tag.rb:162 run> terminated with exception (report_on_exception is true):
Traceback (most recent call last):
13: from ./retro_tag.rb:168:in `block (2 levels) in '
12: from /home/it-services/RetroTag/retro-tag/auto_tag/aws_mixin.rb:19:in `write_cache_file'
11: from /home/it-services/RetroTag/retro-tag/aws_resource/default.rb:55:in `get_resources'
10: from /home/it-services/RetroTag/retro-tag/aws_resource/default.rb:55:in `each'
9: from /home/it-services/RetroTag/retro-tag/aws_resource/default.rb:61:in `block in get_resources'
8: from /var/lib/gems/2.7.0/gems/aws-sdk-iam-1.56.0/lib/aws-sdk-iam/client.rb:9044:in `list_users'
7: from /var/lib/gems/2.7.0/gems/aws-sdk-core-3.117.0/lib/seahorse/client/request.rb:72:in `send_request'
6: from /var/lib/gems/2.7.0/gems/aws-sdk-core-3.117.0/lib/seahorse/client/plugins/response_target.rb:24:in `call'
5: from /var/lib/gems/2.7.0/gems/aws-sdk-core-3.117.0/lib/aws-sdk-core/plugins/response_paging.rb:12:in `call'
4: from /var/lib/gems/2.7.0/gems/aws-sdk-core-3.117.0/lib/seahorse/client/plugins/request_callback.rb:71:in `call'
3: from /var/lib/gems/2.7.0/gems/aws-sdk-core-3.117.0/lib/aws-sdk-core/plugins/param_converter.rb:26:in `call'
2: from /var/lib/gems/2.7.0/gems/aws-sdk-core-3.117.0/lib/aws-sdk-core/plugins/idempotency_token.rb:19:in `call'
1: from /var/lib/gems/2.7.0/gems/aws-sdk-core-3.117.0/lib/aws-sdk-core/plugins/jsonvalue_converter.rb:22:in `call'
/var/lib/gems/2.7.0/gems/aws-sdk-core-3.117.0/lib/seahorse/client/plugins/raise_response_errors.rb:17:in `call': The security token included in the request is invalid. (Aws::IAM::Errors::InvalidClientTokenId)
Traceback (most recent call last):
13: from ./retro_tag.rb:168:in `block (2 levels) in '
12: from /home/it-services/RetroTag/retro-tag/auto_tag/aws_mixin.rb:19:in `write_cache_file'
11: from /home/it-services/RetroTag/retro-tag/aws_resource/default.rb:55:in `get_resources'
10: from /home/it-services/RetroTag/retro-tag/aws_resource/default.rb:55:in `each'
9: from /home/it-services/RetroTag/retro-tag/aws_resource/default.rb:61:in `block in get_resources'
8: from /var/lib/gems/2.7.0/gems/aws-sdk-iam-1.56.0/lib/aws-sdk-iam/client.rb:8226:in `list_roles'
7: from /var/lib/gems/2.7.0/gems/aws-sdk-core-3.117.0/lib/seahorse/client/request.rb:72:in `send_request'
6: from /var/lib/gems/2.7.0/gems/aws-sdk-core-3.117.0/lib/seahorse/client/plugins/response_target.rb:24:in `call'
5: from /var/lib/gems/2.7.0/gems/aws-sdk-core-3.117.0/lib/aws-sdk-core/plugins/response_paging.rb:12:in `call'
4: from /var/lib/gems/2.7.0/gems/aws-sdk-core-3.117.0/lib/seahorse/client/plugins/request_callback.rb:71:in `call'
3: from /var/lib/gems/2.7.0/gems/aws-sdk-core-3.117.0/lib/aws-sdk-core/plugins/param_converter.rb:26:in `call'
2: from /var/lib/gems/2.7.0/gems/aws-sdk-core-3.117.0/lib/aws-sdk-core/plugins/idempotency_token.rb:19:in `call'
1: from /var/lib/gems/2.7.0/gems/aws-sdk-core-3.117.0/lib/aws-sdk-core/plugins/jsonvalue_converter.rb:22:in `call'
/var/lib/gems/2.7.0/gems/aws-sdk-core-3.117.0/lib/seahorse/client/plugins/raise_response_errors.rb:17:in `call': The security token included in the request is invalid. (Aws::IAM::Errors::InvalidClientTokenId)

[ecout]

Please read the AWS documentation on disabling regions, this is not related to this application but the AWS environment itself and is expected.
https://docs.aws.amazon.com/general/latest/gr/rande-manage.html

Most regions cannot be disabled, but some are disabled by default which is why you're seeing here.
Other than that, make sure you gave your scan-profile IAM user the ReadOnly AWS managed policy.

[rayjanoka]

It looks like your keys just weren't working, you shouldn't need the scan_access_keys if you are setting the scan_profile.

I'm not sure what you mean by it won't run without those settings...please send the failure output if that is the case so we can troubleshoot.