aws / aws/aws-cli

Windows 11: AWS CLI fails to start because Smart App Control blocks unsigned _awscrt.pyd

Open
#10,614 1 comment 1 reaction 1 assignee Claimed by @RyanFitzSimmonsAK View on GitHub
bug investigating p2
Dominant language
Python
Stars
17.3k
Forks
4.6k
Avg merge
1d 2h
Merged PRs (30d)
13

Description

### Describe the bug

AWS CLI fails during startup on my personal Windows 11 laptop with Smart App Control enabled. Even `aws --version` fails.

Windows Event Viewer records CodeIntegrity event 3077, identifying `_awscrt.pyd` in the AWS CLI installation directory as the blocked component.

Running Get-AuthenticodeSignature against that file returns `NotSigned`.

The problem occurs in both standalone PowerShell and Git Bash inside IntelliJ. Updating/reinstalling with the official current-user Windows installer did not resolve it.

Could you investigate whether this Windows distribution includes an unsigned component and advise on a supported fix that keeps Smart App Control enabled?

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Expected Behavior

`aws --version` should display the installed AWS CLI version and exit successfully without requiring Smart App Control to be disabled.

### Current Behavior

AWS CLI exits before executing the command:

ImportError: DLL load failed while importing _awscrt: An Application Control policy has blocked this file.
[PYI-8784:ERROR] Failed to execute script 'aws' due to unhandled exception!

Event Viewer:
Event ID: 3077
Source: CodeIntegrity
AWS CLI attempted to load `_awscrt.pyd`, which did not meet the Enterprise signing level requirements or violated the code integrity policy.

Signature check:
Status: NotSigned
StatusMessage: The file is not digitally signed.

### Reproduction Steps

1. Use Windows 11 with Smart App Control enabled.

2. Install AWS CLI v2 using the official Windows current-user installer.

3. Open PowerShell or Git Bash.

4. Run:

aws --version

5. Observe the startup failure.

6. Open Event Viewer → Applications and Services Logs → Microsoft → Windows → CodeIntegrity → Operational.

7. Observe event 3077 identifying `_awscrt.pyd` as blocked.

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CLI version used

aws-cli/2.36.25 Python/3.14.6 Windows/11 script-exe/AMD64

### Environment details (OS name and version, etc.)

Windows 11, x64

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.