# Invalid security\_token in cloudformation module

**URL:** <https://forum.ansible.com/t/invalid-security-token-in-cloudformation-module/18953>\
**Category:** Ansible Project\
**Tags:** aws\
**Created:** [August 5, 2015, 3:27pm UTC](https://forum.ansible.com/t/invalid-security-token-in-cloudformation-module/18953 "2015-08-05T15:27:16Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vicent\_Soria](https://avatars.discourse-cdn.com/v4/letter/v/6de8d8/32.png) [@Vicent\_Soria](https://forum.ansible.com/u/Vicent_Soria)\
**Post date:** [August 5, 2015, 3:27pm UTC](https://forum.ansible.com/t/invalid-security-token-in-cloudformation-module/18953/1 "2015-08-05T15:27:16Z")

</div>

Hi,

I’m trying to manage a cloudformation stack with assume role credentials.

I exported AWS\_ACCESS\_KEY\_ID, AWS\_SECRET\_ACCESS\_KEY and AWS\_SECURITY\_TOKEN as environment variables.

```auto
- name: my cloudformation task
  cloudformation:
    stack_name: "my_stack"
    region: "{{ region }}"
    template: "template.json"
    state: present

```

When I run the playbook, this is the error:

> failed: [localhost] =\> {“failed”: true}  
> msg: The security token included in the request is invalid.

If I try to create an ec2 key, it works fine:

- name: test  
ec2\_key:  
region: “{{ region }}”  
name: example

```auto
    state: present

```

I tried with temporary credentials created with aws cli and boto.

I have ansible 1.9.2 and boto 2.38 installed.

Could you help me?

Thank you!

---

<div class="post-metadata">

**Author:** ![Vicent\_Soria](https://avatars.discourse-cdn.com/v4/letter/v/6de8d8/32.png) [@Vicent\_Soria](https://forum.ansible.com/u/Vicent_Soria)\
**Post date:** [August 13, 2015, 5:25pm UTC](https://forum.ansible.com/t/invalid-security-token-in-cloudformation-module/18953/2 "2015-08-13T17:25:53Z")

</div>

Anyone?

---

<div class="post-metadata">

**Author:** ![Dan\_Farrell](https://avatars.discourse-cdn.com/v4/letter/d/f08c70/32.png) [@Dan\_Farrell](https://forum.ansible.com/u/Dan_Farrell)\
**Post date:** [September 23, 2015, 2:29am UTC](https://forum.ansible.com/t/invalid-security-token-in-cloudformation-module/18953/3 "2015-09-23T02:29:01Z")

</div>

yeah, what gives? The CLI commands work fine in my environment too.

---

<div class="post-metadata">

**Author:** ![John\_Heller](https://avatars.discourse-cdn.com/v4/letter/j/2bfe46/32.png) [@John\_Heller](https://forum.ansible.com/u/John_Heller)\
**Post date:** [October 22, 2015, 3:11am UTC](https://forum.ansible.com/t/invalid-security-token-in-cloudformation-module/18953/4 "2015-10-22T03:11:00Z")

</div>

I’ve encountered this too. After some investigation, I’ve discovered its a [bug](https://github.com/boto/boto/pull/2100) in Ansible/boto. The security token is not being passed through to boto and the AWS API call.

Looking at GitHub, it has been fixed, and the fix is in the v2.0 code, but it did not make it to the 1.9.x code. Go figure.

I got around it by copying the v2 cloudformation module code into my module library. That works properly with assumed role credentials, and appears to be otherwise backward compatible.