How to fix UnrecognizedClientException: The security token included in the request is invalid in DynamoDB

# Check environment variables
echo $AWS_ACCESS_KEY_ID
echo $AWS_SECRET_ACCESS_KEY
echo $AWS_SESSION_TOKEN  # If using temporary credentials

# Check AWS CLI configuration
aws configure list

# Check credentials file
cat ~/.aws/credentials

# Test credentials with a simple AWS command
aws sts get-caller-identity

# For IAM users, check when access key was last rotated
aws iam list-access-keys --user-name YourUserName

# For temporary credentials (STS), check expiration
aws sts get-session-token --duration-seconds 3600

# Create new access key if needed (save the secret key immediately!)
aws iam create-access-key --user-name YourUserName

# Rotate old access keys
aws iam update-access-key --user-name YourUserName --access-key-id OLD_KEY_ID --status Inactive
aws iam delete-access-key --user-name YourUserName --access-key-id OLD_KEY_ID

# Check attached policies for an IAM user
aws iam list-attached-user-policies --user-name YourUserName
aws iam list-user-policies --user-name YourUserName

# Check attached policies for an IAM role
aws iam list-attached-role-policies --role-name YourRoleName
aws iam list-role-policies --role-name YourRoleName

# Get policy document to review permissions
aws iam get-policy --policy-arn arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess
aws iam get-policy-version --policy-arn arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess --version-id v1

# Simulate permissions for specific DynamoDB actions
aws iam simulate-principal-policy   --policy-source-arn arn:aws:iam::123456789012:user/YourUserName   --action-names dynamodb:PutItem dynamodb:GetItem dynamodb:Query

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dynamodb:PutItem",
        "dynamodb:GetItem",
        "dynamodb:UpdateItem",
        "dynamodb:DeleteItem",
        "dynamodb:Query",
        "dynamodb:Scan",
        "dynamodb:BatchWriteItem",
        "dynamodb:BatchGetItem"
      ],
      "Resource": "arn:aws:dynamodb:region:account:table/YourTableName"
    }
  ]
}

// AWS SDK v3 for JavaScript
import { DynamoDBClient } from '@aws-sdk/client-dynamodb';
import { fromNodeProviderChain } from '@aws-sdk/credential-providers';

// Method 1: Default credential provider chain (recommended)
const client = new DynamoDBClient({
  region: 'us-east-1',
  credentials: fromNodeProviderChain(),
});

// Method 2: Explicit credentials (for testing/debugging)
import { fromEnv } from '@aws-sdk/credential-providers';
const client = new DynamoDBClient({
  region: 'us-east-1',
  credentials: fromEnv(), // Uses AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY
});

// Method 3: Shared credentials file with specific profile
import { fromIni } from '@aws-sdk/credential-providers';
const client = new DynamoDBClient({
  region: 'us-east-1',
  credentials: fromIni({ profile: 'production' }),
});

// Method 4: EC2 instance metadata service (for EC2/ECS)
import { fromInstanceMetadata } from '@aws-sdk/credential-providers';
const client = new DynamoDBClient({
  region: 'us-east-1',
  credentials: fromInstanceMetadata(),
});

// Assuming a role for cross-account access
import { STSClient, AssumeRoleCommand } from '@aws-sdk/client-sts';
import { fromTemporaryCredentials } from '@aws-sdk/credential-providers';

const stsClient = new STSClient({ region: 'us-east-1' });

const assumeRoleResponse = await stsClient.send(new AssumeRoleCommand({
  RoleArn: 'arn:aws:iam::123456789012:role/CrossAccountDynamoDBRole',
  RoleSessionName: 'MySession',
  DurationSeconds: 3600,
}));

const dynamoDBClient = new DynamoDBClient({
  region: 'us-east-1',
  credentials: {
    accessKeyId: assumeRoleResponse.Credentials.AccessKeyId,
    secretAccessKey: assumeRoleResponse.Credentials.SecretAccessKey,
    sessionToken: assumeRoleResponse.Credentials.SessionToken,
  },
});

// Alternative: Using credential provider
const client = new DynamoDBClient({
  region: 'us-east-1',
  credentials: fromTemporaryCredentials({
    params: {
      RoleArn: 'arn:aws:iam::123456789012:role/CrossAccountDynamoDBRole',
      RoleSessionName: 'MySession',
    },
    masterCredentials: fromNodeProviderChain(),
  }),
});

// Example: Credential refresh with exponential backoff
class DynamoDBClientWithRefresh {
  constructor() {
    this.client = null;
    this.credentialExpiry = null;
    this.initializeClient();
  }

  async initializeClient() {
    try {
      const credentials = await this.getFreshCredentials();
      this.client = new DynamoDBClient({
        region: 'us-east-1',
        credentials,
      });
      this.credentialExpiry = new Date(Date.now() + 55 * 60 * 1000); // Refresh 5 min before expiry
    } catch (error) {
      console.error('Failed to initialize DynamoDB client:', error);
      // Retry with exponential backoff
      setTimeout(() => this.initializeClient(), this.getRetryDelay());
    }
  }

  async getFreshCredentials() {
    // Implement your credential refresh logic
    // Could be STS assume-role, secrets manager, etc.
    return fromNodeProviderChain()();
  }

  async query(params) {
    // Check if credentials need refresh
    if (this.credentialExpiry && Date.now() > this.credentialExpiry) {
      await this.refreshCredentials();
    }

    try {
      return await this.client.send(new QueryCommand(params));
    } catch (error) {
      if (error.name === 'UnrecognizedClientException') {
        // Credentials invalid, refresh and retry once
        await this.refreshCredentials();
        return await this.client.send(new QueryCommand(params));
      }
      throw error;
    }
  }

  getRetryDelay(retryCount = 0) {
    const baseDelay = 1000; // 1 second
    const maxDelay = 30000; // 30 seconds
    return Math.min(maxDelay, baseDelay * Math.pow(2, retryCount));
  }
}