How to fix MissingAuthenticationTokenException: Missing Authentication Token in DynamoDB

# Check environment variables
echo $AWS_ACCESS_KEY_ID
echo $AWS_SECRET_ACCESS_KEY
echo $AWS_SESSION_TOKEN  # For temporary credentials
echo $AWS_DEFAULT_REGION

# Check AWS credentials file
cat ~/.aws/credentials
cat ~/.aws/config

# Test AWS CLI configuration
aws configure list
aws sts get-caller-identity

export AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
   export AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
   export AWS_DEFAULT_REGION=us-east-1

[default]
   aws_access_key_id = AKIAIOSFODNN7EXAMPLE
   aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

   [production]
   aws_access_key_id = AKIAI44QH8DHBEXAMPLE
   aws_secret_access_key = je7MtGbClwBF/2Zp9Utk/h3yCo8nvbEXAMPLEKEY

// AWS SDK v3 for JavaScript
import { DynamoDBClient } from '@aws-sdk/client-dynamodb';
import { fromIni } from '@aws-sdk/credential-providers';

// Option 1: Explicit credentials
const client1 = new DynamoDBClient({
  region: 'us-east-1',
  credentials: {
    accessKeyId: 'AKIAIOSFODNN7EXAMPLE',
    secretAccessKey: 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',
    sessionToken: 'AQoEXAMPLEH4aoAH0gNCAPy...' // For temporary credentials
  }
});

// Option 2: Use specific profile from credentials file
const client2 = new DynamoDBClient({
  region: 'us-east-1',
  credentials: fromIni({ profile: 'production' })
});

// Option 3: Use default credential chain (recommended for production)
const client3 = new DynamoDBClient({
  region: process.env.AWS_REGION || 'us-east-1'
});

// Python example (boto3)
import boto3
from botocore.config import Config

# Explicit credentials
dynamodb = boto3.client(
    'dynamodb',
    aws_access_key_id='AKIAIOSFODNN7EXAMPLE',
    aws_secret_access_key='wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',
    region_name='us-east-1'
)

# Use profile
dynamodb = boto3.client('dynamodb', region_name='us-east-1', profile_name='production')

# Check current IAM identity
aws sts get-caller-identity

# List attached policies for IAM user
aws iam list-attached-user-policies --user-name YourUserName

# List attached policies for IAM role
aws iam list-attached-role-policies --role-name YourRoleName

# Test DynamoDB permissions
aws dynamodb list-tables --region us-east-1

# Minimal DynamoDB policy for basic operations
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dynamodb:GetItem",
        "dynamodb:PutItem",
        "dynamodb:UpdateItem",
        "dynamodb:DeleteItem",
        "dynamodb:Query",
        "dynamodb:Scan",
        "dynamodb:BatchGetItem",
        "dynamodb:BatchWriteItem"
      ],
      "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/YourTableName"
    }
  ]
}

// AWS SDK v3 automatically refreshes temporary credentials
import { DynamoDBClient } from '@aws-sdk/client-dynamodb';
import { fromTemporaryCredentials } from '@aws-sdk/credential-providers';

// Using IAM role with automatic refresh
const client = new DynamoDBClient({
  region: 'us-east-1',
  credentials: fromTemporaryCredentials({
    params: {
      RoleArn: 'arn:aws:iam::123456789012:role/YourRoleName',
      RoleSessionName: 'dynamodb-session'
    },
    // Optional: Custom STS client configuration
    clientConfig: { region: 'us-east-1' }
  })
});

// Manual credential refresh example
async function refreshCredentials() {
  const sts = new STSClient({ region: 'us-east-1' });
  const command = new AssumeRoleCommand({
    RoleArn: 'arn:aws:iam::123456789012:role/YourRoleName',
    RoleSessionName: 'session-' + Date.now(),
    DurationSeconds: 3600
  });

  const response = await sts.send(command);
  return {
    accessKeyId: response.Credentials.AccessKeyId,
    secretAccessKey: response.Credentials.SecretAccessKey,
    sessionToken: response.Credentials.SessionToken,
    expiration: response.Credentials.Expiration
  };
}

// Python example with boto3 session refresh
import boto3
from botocore.exceptions import ClientError

def get_fresh_session():
    # boto3 automatically handles credential refresh for IAM roles
    session = boto3.Session()
    sts = session.client('sts')

    try:
        # Get fresh credentials
        response = sts.assume_role(
            RoleArn='arn:aws:iam::123456789012:role/YourRoleName',
            RoleSessionName='dynamodb-session'
        )

        # Create new session with fresh credentials
        return boto3.Session(
            aws_access_key_id=response['Credentials']['AccessKeyId'],
            aws_secret_access_key=response['Credentials']['SecretAccessKey'],
            aws_session_token=response['Credentials']['SessionToken']
        )
    except ClientError as e:
        print(f"Failed to assume role: {e}")
        raise

# Enable AWS SDK debug logging
export AWS_SDK_LOAD_CONFIG=1
export AWS_SHARED_CREDENTIALS_FILE=~/.aws/credentials
export AWS_CONFIG_FILE=~/.aws/config
export AWS_PROFILE=production  # Explicitly set profile
export DEBUG=*  # Node.js debug
export NODE_DEBUG=http,aws-sdk  # Node.js specific

# For Java applications
export AWS_ACCESS_KEY_ID=...
export AWS_SECRET_ACCESS_KEY=...
export AWS_SESSION_TOKEN=...
export AWS_DEFAULT_REGION=us-east-1

# Test with AWS CLI debug mode
aws dynamodb list-tables --debug --region us-east-1

# Check credential provider chain
# Node.js: Add credential provider logging
import { defaultProvider } from '@aws-sdk/credential-provider-node';
import { fromNodeProviderChain } from '@aws-sdk/credential-providers';

const credentials = await fromNodeProviderChain()();
console.log('Resolved credentials:', credentials);

// Environment-based configuration
function createDynamoDBClient() {
  const env = process.env.NODE_ENV || 'development';
  const region = process.env.AWS_REGION || 'us-east-1';

  switch (env) {
    case 'production':
      // Use IAM role (automatic)
      return new DynamoDBClient({ region });

    case 'staging':
      // Use environment variables or instance profile
      return new DynamoDBClient({ region });

    case 'development':
    case 'test':
      // Local development with named profile
      const { fromIni } = require('@aws-sdk/credential-providers');
      return new DynamoDBClient({
        region,
        credentials: fromIni({ profile: 'dev' }),
        endpoint: process.env.DYNAMODB_ENDPOINT || undefined // For local DynamoDB
      });

    default:
      throw new Error('Unknown environment: ' + env);
  }
}

// Docker/container configuration