AuthFailure: AWS was not able to validate the provided access credentials / status code: 401

_This issue was originally opened by @micchickenburger as hashicorp/packer#10302. It was migrated here as a result of the [Packer plugin split](https://github.com/hashicorp/packer/issues/8610#issuecomment-770034737). The original body of the issue is below._

---

#### Overview of the Issue

Packer throws a 401 unauthorized error when using [aws-vault](https://github.com/99designs/aws-vault). Terraform works fine, as well as any other aws command.

#### Reproduction Steps

In all examples, replace `` with the name of the pre-created aws-vault profile.

```shell
$ aws-vault exec -- packer build packer.json
```

However, these all work fine:

```shell
$ aws-vault exec -- terraform apply
...
$ aws-vault exec -- aws s3 ls
...
```

And the environment:

```shell
$ aws-vault exec -- env | grep AWS
AWS_VAULT=[redacted]
AWS_DEFAULT_REGION=us-east-2
AWS_REGION=us-east-2
AWS_ACCESS_KEY_ID=[redacted]
AWS_SECRET_ACCESS_KEY=[redacted]
AWS_SESSION_TOKEN=[redacted]
AWS_SECURITY_TOKEN=[redacted]
AWS_SESSION_EXPIRATION=2020-11-24T10:00:24Z
```

### Packer version

Packer version: 1.6.5 [go1.15.3 darwin amd64]

### Simplified Packer Buildfile

```json
{
"variables": {
"aws_access_key": "{{env `AWS_ACCESS_KEY_ID`}}",
"aws_secret_key": "{{env `AWS_SECRET_ACCESS_KEY`}}",
"aws_region": "{{env `AWS_DEFAULT_REGION`}}",
"environment": "{{env `TF_VAR_environment`}}"
},
"builders": [
{
"type": "amazon-ebs",
"access_key": "{{user `aws_access_key`}}",
"secret_key": "{{user `aws_secret_key`}}",
"region": "{{user `aws_region`}}",
"source_ami_filter": {
"filters": {
"virtualization-type": "hvm",
"name": "ubuntu/images/*ubuntu-bionic-18.04-amd64-server-*",
"root-device-type": "ebs"
},
"owners": ["099720109477"],
"most_recent": true
},
"instance_type": "t2.micro",
"ssh_username": "ubuntu",
"ami_name": "app-{{user `environment`}}-{{timestamp}}"
}
],
"provisioners": []
}
```

### Operating system and Environment details

macOS Big Sur 11.0.1, aws-vault version 6.2.0

### Log Fragments and crash.log files

```shell
$ aws-vault exec -- packer build packer.json
2020/11/24 03:09:01 [INFO] Packer version: 1.6.5 [go1.15.3 darwin amd64]
2020/11/24 03:09:01 Checking 'PACKER_CONFIG' for a config file path
2020/11/24 03:09:01 'PACKER_CONFIG' not set; checking the default config file path
2020/11/24 03:09:01 Attempting to open config file: /[redacted]/.packerconfig
2020/11/24 03:09:01 [WARN] Config file doesn't exist: /[redacted]/.packerconfig
2020/11/24 03:09:01 Setting cache directory: /[redacted]/packer_cache
2020/11/24 03:09:01 Creating plugin client for path: /usr/local/bin/packer
2020/11/24 03:09:01 Starting plugin: /usr/local/bin/packer []string{"/usr/local/bin/packer", "plugin", "packer-builder-amazon-ebs"}
2020/11/24 03:09:01 Waiting for RPC address for: /usr/local/bin/packer
2020/11/24 03:09:01 packer-builder-amazon-ebs plugin: [INFO] Packer version: 1.6.5 [go1.15.3 darwin amd64]
2020/11/24 03:09:01 packer-builder-amazon-ebs plugin: Checking 'PACKER_CONFIG' for a config file path
2020/11/24 03:09:01 packer-builder-amazon-ebs plugin: 'PACKER_CONFIG' not set; checking the default config file path
2020/11/24 03:09:01 packer-builder-amazon-ebs plugin: Attempting to open config file: /[redacted]/.packerconfig
2020/11/24 03:09:01 packer-builder-amazon-ebs plugin: [WARN] Config file doesn't exist: /[redacted]/.packerconfig
2020/11/24 03:09:01 packer-builder-amazon-ebs plugin: Setting cache directory: /[redacted]/packer_cache
2020/11/24 03:09:01 packer-builder-amazon-ebs plugin: args: []string{"packer-builder-amazon-ebs"}
2020/11/24 03:09:01 Received unix RPC address for /usr/local/bin/packer: addr is /var/folders/kd/0qsg7379351cw6j40x_pg_740000gn/T/packer-plugin703595027
2020/11/24 03:09:01 packer-builder-amazon-ebs plugin: Plugin address: unix /var/folders/kd/0qsg7379351cw6j40x_pg_740000gn/T/packer-plugin703595027
2020/11/24 03:09:01 packer-builder-amazon-ebs plugin: Waiting for connection...
2020/11/24 03:09:01 packer-builder-amazon-ebs plugin: Serving a plugin connection...
2020/11/24 03:09:01 Creating plugin client for path: /usr/local/bin/packer
2020/11/24 03:09:01 Starting plugin: /usr/local/bin/packer []string{"/usr/local/bin/packer", "plugin", "packer-provisioner-shell"}
2020/11/24 03:09:01 Waiting for RPC address for: /usr/local/bin/packer
2020/11/24 03:09:01 packer-provisioner-shell plugin: [INFO] Packer version: 1.6.5 [go1.15.3 darwin amd64]
2020/11/24 03:09:01 packer-provisioner-shell plugin: Checking 'PACKER_CONFIG' for a config file path
2020/11/24 03:09:01 packer-provisioner-shell plugin: 'PACKER_CONFIG' not set; checking the default config file path
2020/11/24 03:09:01 packer-provisioner-shell plugin: Attempting to open config file: /[redacted]/.packerconfig
2020/11/24 03:09:01 packer-provisioner-shell plugin: [WARN] Config file doesn't exist: /[redacted]/.packerconfig
2020/11/24 03:09:01 packer-provisioner-shell plugin: Setting cache directory: /[redacted]/packer_cache
2020/11/24 03:09:01 packer-provisioner-shell plugin: args: []string{"packer-provisioner-shell"}
2020/11/24 03:09:01 Received unix RPC address for /usr/local/bin/packer: addr is /var/folders/kd/0qsg7379351cw6j40x_pg_740000gn/T/packer-plugin096613727
2020/11/24 03:09:01 packer-provisioner-shell plugin: Plugin address: unix /var/folders/kd/0qsg7379351cw6j40x_pg_740000gn/T/packer-plugin096613727
2020/11/24 03:09:01 packer-provisioner-shell plugin: Waiting for connection...
2020/11/24 03:09:01 packer-provisioner-shell plugin: Serving a plugin connection...
2020/11/24 03:09:01 Creating plugin client for path: /usr/local/bin/packer
2020/11/24 03:09:01 Starting plugin: /usr/local/bin/packer []string{"/usr/local/bin/packer", "plugin", "packer-provisioner-file"}
2020/11/24 03:09:01 Waiting for RPC address for: /usr/local/bin/packer
2020/11/24 03:09:01 packer-provisioner-file plugin: [INFO] Packer version: 1.6.5 [go1.15.3 darwin amd64]
2020/11/24 03:09:01 packer-provisioner-file plugin: Checking 'PACKER_CONFIG' for a config file path
2020/11/24 03:09:01 packer-provisioner-file plugin: 'PACKER_CONFIG' not set; checking the default config file path
2020/11/24 03:09:01 packer-provisioner-file plugin: Attempting to open config file: /[redacted]/.packerconfig
2020/11/24 03:09:01 packer-provisioner-file plugin: [WARN] Config file doesn't exist: /[redacted]/.packerconfig
2020/11/24 03:09:01 packer-provisioner-file plugin: Setting cache directory: /[redacted]/packer_cache
2020/11/24 03:09:01 packer-provisioner-file plugin: args: []string{"packer-provisioner-file"}
2020/11/24 03:09:01 packer-provisioner-file plugin: Plugin address: unix /var/folders/kd/0qsg7379351cw6j40x_pg_740000gn/T/packer-plugin074951819
2020/11/24 03:09:01 packer-provisioner-file plugin: Waiting for connection...
2020/11/24 03:09:01 Received unix RPC address for /usr/local/bin/packer: addr is /var/folders/kd/0qsg7379351cw6j40x_pg_740000gn/T/packer-plugin074951819
2020/11/24 03:09:01 packer-provisioner-file plugin: Serving a plugin connection...
2020/11/24 03:09:01 Creating plugin client for path: /usr/local/bin/packer
2020/11/24 03:09:01 Starting plugin: /usr/local/bin/packer []string{"/usr/local/bin/packer", "plugin", "packer-provisioner-shell"}
2020/11/24 03:09:01 Waiting for RPC address for: /usr/local/bin/packer
2020/11/24 03:09:01 packer-provisioner-shell plugin: [INFO] Packer version: 1.6.5 [go1.15.3 darwin amd64]
2020/11/24 03:09:01 packer-provisioner-shell plugin: Checking 'PACKER_CONFIG' for a config file path
2020/11/24 03:09:01 packer-provisioner-shell plugin: 'PACKER_CONFIG' not set; checking the default config file path
2020/11/24 03:09:01 packer-provisioner-shell plugin: Attempting to open config file: /[redacted]/.packerconfig
2020/11/24 03:09:01 packer-provisioner-shell plugin: [WARN] Config file doesn't exist: /[redacted]/.packerconfig
2020/11/24 03:09:01 packer-provisioner-shell plugin: Setting cache directory: /[redacted]/packer_cache
2020/11/24 03:09:01 packer-provisioner-shell plugin: args: []string{"packer-provisioner-shell"}
2020/11/24 03:09:01 Received unix RPC address for /usr/local/bin/packer: addr is /var/folders/kd/0qsg7379351cw6j40x_pg_740000gn/T/packer-plugin207874823
2020/11/24 03:09:01 packer-provisioner-shell plugin: Plugin address: unix /var/folders/kd/0qsg7379351cw6j40x_pg_740000gn/T/packer-plugin207874823
2020/11/24 03:09:01 packer-provisioner-shell plugin: Waiting for connection...
2020/11/24 03:09:01 packer-provisioner-shell plugin: Serving a plugin connection...
2020/11/24 03:09:01 Preparing build: amazon-ebs
2020/11/24 03:09:01 packer-builder-amazon-ebs plugin: [INFO] (aws): No AWS timeout and polling overrides have been set. Packer will default to waiter-specific delays and timeouts. If you would like to customize the length of time between retries and max number of retries you may do so by setting the environment variables AWS_POLL_DELAY_SECONDS and AWS_MAX_ATTEMPTS or the configuration options aws_polling_delay_seconds and aws_polling_max_attempts to your desired values.
2020/11/24 03:09:01 Build debug mode: false
2020/11/24 03:09:01 Force build: false
2020/11/24 03:09:01 On error:
2020/11/24 03:09:01 Waiting on builds to complete...
2020/11/24 03:09:01 Starting build run: amazon-ebs
2020/11/24 03:09:01 Running builder: amazon-ebs
2020/11/24 03:09:01 [INFO] (telemetry) Starting builder amazon-ebs
amazon-ebs: output will be in this color.

2020/11/24 03:09:01 packer-builder-amazon-ebs plugin: [INFO] AWS Auth provider used: "StaticProvider"
2020/11/24 03:09:01 packer-builder-amazon-ebs plugin: Found region us-east-2
2020/11/24 03:09:01 packer-builder-amazon-ebs plugin: [INFO] AWS Auth provider used: "StaticProvider"
2020/11/24 03:09:01 [INFO] (telemetry) ending amazon-ebs
status code: 401, request id: e11dfb0e-e505-4268-81ef-c482960ff3a8
==> Wait completed after 407 milliseconds 791 microseconds
2020/11/24 03:09:01 machine readable: error-count []string{"1"}
==> Some builds didn't complete successfully and had errors:
2020/11/24 03:09:01 machine readable: amazon-ebs,error []string{"error validating regions: AuthFailure: AWS was not able to validate the provided access credentials\n\tstatus code: 401, request id: e11dfb0e-e505-4268-81ef-c482960ff3a8"}
status code: 401, request id: e11dfb0e-e505-4268-81ef-c482960ff3a8
==> Builds finished but no artifacts were created.
2020/11/24 03:09:01 [INFO] (telemetry) Finalizing.
Build 'amazon-ebs' errored after 407 milliseconds 636 microseconds: error validating regions: AuthFailure: AWS was not able to validate the provided access credentials
status code: 401, request id: e11dfb0e-e505-4268-81ef-c482960ff3a8

==> Wait completed after 407 milliseconds 791 microseconds

==> Some builds didn't complete successfully and had errors:
--> amazon-ebs: error validating regions: AuthFailure: AWS was not able to validate the provided access credentials
status code: 401, request id: e11dfb0e-e505-4268-81ef-c482960ff3a8

==> Builds finished but no artifacts were created.
2020/11/24 03:09:02 waiting for all plugin processes to complete...
2020/11/24 03:09:02 /usr/local/bin/packer: plugin process exited
2020/11/24 03:09:02 /usr/local/bin/packer: plugin process exited
2020/11/24 03:09:02 /usr/local/bin/packer: plugin process exited
2020/11/24 03:09:02 /usr/local/bin/packer: plugin process exited
```