Skip to main content

AWS001 - AWS Authentication Failed

Agent error code #AWS001 indicates that AWS rejected the agent's credentials. The request reached AWS and was refused before any permission check took place.

AWS returns AuthFailure, InvalidClientTokenId or SignatureDoesNotMatch in this situation, which is worth knowing if you are correlating against CloudTrail.

Common causes include:

  • The access key ID or secret access key on the knoc is wrong or has a stray character
  • The access key was deactivated or deleted in IAM
  • The credentials belong to a different AWS account from the security group
  • The agent host's clock has drifted far enough to invalidate the request signature

Steps to Resolve

Re-enter the Credentials

  1. In the Knocknoc admin interface, open the backend configuration for the affected knoc
  2. Re-enter the access key ID and secret access key, taking care not to include leading or trailing whitespace
  3. Save and retry the grant

Confirm the Key Is Active

  1. In the AWS console, go to IAM > Users > the user in question > Security credentials
  2. Confirm the access key is listed and its status is Active
  3. If it was deleted or deactivated, create a new key and update the knoc

Check the Agent Host Clock

A signature is only valid within a narrow time window.

  1. Run timedatectl status on the agent host
  2. Confirm NTP synchronization is active and the clock is correct

Verify From the Agent Host

sudo -u knocknoc aws sts get-caller-identity --region <region>

A successful call prints the account and ARN the agent is authenticating as. Confirm the account matches the one holding the security group.

Back to top