AWS CLI Commands Working Okay Locally, but Getting Errors on Windows Server 2016

Title: Resolving "OSError: Tunnel connection failed: 400 Bad Request" with AWS CLI on Windows Server 2016

In this article, we'll discuss how to resolve the "OSError: Tunnel connection failed: 400 Bad Request" issue when using AWS CLI on Windows Server 2016.

Understanding the Issue

When using AWS CLI on Windows Server 2016, you might encounter the following error:

OSError: Tunnel connection failed: 400 Bad Request

This error occurs due to a misconfiguration in the AWS CLI or the AWS Managed Microsoft Active Directory (AWS Managed AD).

Prerequisites

Before proceeding, ensure you have the following:

1. AWS CLI installed on your Windows Server 2016 machine.
2. AWS Managed AD configured and connected to your AWS account.

Resolving the Issue

To resolve the "OSError: Tunnel connection failed: 400 Bad Request" issue, follow these steps:

1. Check AWS CLI Version

   First, verify that you're using the latest AWS CLI version. Open a command prompt and run:

   aws --version
   

   If you're not using the latest version, update AWS CLI using the following command:

   aws upgrade --install-dir=C:\aws
   

2. Configure AWS CLI

   Ensure that your AWS CLI is configured to use the correct AWS Managed AD credentials. Run the following command:

   aws configure
   

   Enter the following when prompted:

   • AWS Access Key ID: Your AWS access key ID
   • AWS Secret Access Key: Your AWS secret access key
   • Default region name: Your AWS region
   • Default output format: json

   Instead of entering your AWS access key ID and secret access key, you can also use AWS STS AssumeRole to get temporary credentials.

3. Check AWS Managed AD Configuration

   Ensure that your AWS Managed AD is properly configured and connected to your AWS account. Check the following:

   • Your AWS Managed AD is in the same region as your AWS CLI.
   • Your AWS Managed AD is enabled for AWS Single Sign-On (SSO).
   • Your AWS Managed AD has the correct trust relationship with AWS.

4. Update AWS CLI Configuration

   After configuring AWS CLI and checking AWS Managed AD, update your AWS CLI configuration to use the correct AWS Managed AD endpoint.

   Open the C:\Users\<YourUsername>\.aws\config file in a text editor and add the following:

   [profile <YourProfileName>]
   region = <YourAWSRegion>
   sso_start_url = https://<YourAWSManagedADDomainName>.awsapps.com/start
   sso_region = <YourAWSRegion>
   

   Replace <YourUsername>, <YourProfileName>, <YourAWSRegion>, and <YourAWSManagedADDomainName> with the appropriate values.

5. Test AWS CLI

   Finally, test your AWS CLI by running a simple command, such as:

   aws ec2 describe-instances
   

   If everything is configured correctly, you should see a list of your EC2 instances.

Summary

In this article, we discussed the "OSError: Tunnel connection failed: 400 Bad Request" issue when using AWS CLI on Windows Server 2016 and provided solutions to resolve it. By checking the AWS CLI version, configuring AWS CLI, checking AWS Managed AD configuration, updating AWS CLI configuration, and testing AWS CLI, you should be able to resolve the issue.

References

• AWS CLI User Guide
• AWS Managed Microsoft AD
• AWS Single Sign-On