Error: DynamoDB - The Security Token Included In The Request Is Invalid

The security token included in the request is invalid means AWS rejected the credentials used to sign the request. It is different from an authenticated caller lacking DynamoDB permission.

1. Verify the credential source used by the failing process. Environment variables can override the profile you intended to use.
2. For temporary credentials, supply a matching access key, secret key and session token from the same session. Do not mix values from different refreshes.
3. Renew an expired SSO or assumed-role session and let the SDK credential provider refresh credentials automatically.
4. Check for disabled keys, copied whitespace and stale deployment configuration. Dummy Local credentials work only with an explicit local endpoint.

aws sso login --profile app
aws sts get-caller-identity --profile app

The login command applies to an SSO profile. If STS succeeds but the app fails, compare its credential chain rather than rotating unrelated keys. Do not log or paste secret keys or session tokens while debugging. A timestamp-related InvalidSignatureException needs clock-skew investigation instead.

See SSO profile guidance and AWS documentation.