Describe the bug
AWS CLI fails during startup on my personal Windows 11 laptop with Smart App Control enabled. Even aws --version fails.
Windows Event Viewer records CodeIntegrity event 3077, identifying _awscrt.pyd in the AWS CLI installation directory as the blocked component.
Running Get-AuthenticodeSignature against that file returns NotSigned.
The problem occurs in both standalone PowerShell and Git Bash inside IntelliJ. Updating/reinstalling with the official current-user Windows installer did not resolve it.
Could you investigate whether this Windows distribution includes an unsigned component and advise on a supported fix that keeps Smart App Control enabled?
Regression Issue
Expected Behavior
aws --version should display the installed AWS CLI version and exit successfully without requiring Smart App Control to be disabled.
Current Behavior
AWS CLI exits before executing the command:
ImportError: DLL load failed while importing _awscrt: An Application Control policy has blocked this file.
[PYI-8784:ERROR] Failed to execute script 'aws' due to unhandled exception!
Event Viewer:
Event ID: 3077
Source: CodeIntegrity
AWS CLI attempted to load _awscrt.pyd, which did not meet the Enterprise signing level requirements or violated the code integrity policy.
Signature check:
Status: NotSigned
StatusMessage: The file is not digitally signed.
Reproduction Steps
-
Use Windows 11 with Smart App Control enabled.
-
Install AWS CLI v2 using the official Windows current-user installer.
-
Open PowerShell or Git Bash.
-
Run:
aws --version
-
Observe the startup failure.
-
Open Event Viewer → Applications and Services Logs → Microsoft → Windows → CodeIntegrity → Operational.
-
Observe event 3077 identifying _awscrt.pyd as blocked.
Possible Solution
No response
Additional Information/Context
No response
CLI version used
aws-cli/2.36.25 Python/3.14.6 Windows/11 script-exe/AMD64
Environment details (OS name and version, etc.)
Windows 11, x64
Describe the bug
AWS CLI fails during startup on my personal Windows 11 laptop with Smart App Control enabled. Even
aws --versionfails.Windows Event Viewer records CodeIntegrity event 3077, identifying
_awscrt.pydin the AWS CLI installation directory as the blocked component.Running Get-AuthenticodeSignature against that file returns
NotSigned.The problem occurs in both standalone PowerShell and Git Bash inside IntelliJ. Updating/reinstalling with the official current-user Windows installer did not resolve it.
Could you investigate whether this Windows distribution includes an unsigned component and advise on a supported fix that keeps Smart App Control enabled?
Regression Issue
Expected Behavior
aws --versionshould display the installed AWS CLI version and exit successfully without requiring Smart App Control to be disabled.Current Behavior
AWS CLI exits before executing the command:
ImportError: DLL load failed while importing _awscrt: An Application Control policy has blocked this file.
[PYI-8784:ERROR] Failed to execute script 'aws' due to unhandled exception!
Event Viewer:
Event ID: 3077
Source: CodeIntegrity
AWS CLI attempted to load
_awscrt.pyd, which did not meet the Enterprise signing level requirements or violated the code integrity policy.Signature check:
Status: NotSigned
StatusMessage: The file is not digitally signed.
Reproduction Steps
Use Windows 11 with Smart App Control enabled.
Install AWS CLI v2 using the official Windows current-user installer.
Open PowerShell or Git Bash.
Run:
aws --version
Observe the startup failure.
Open Event Viewer → Applications and Services Logs → Microsoft → Windows → CodeIntegrity → Operational.
Observe event 3077 identifying
_awscrt.pydas blocked.Possible Solution
No response
Additional Information/Context
No response
CLI version used
aws-cli/2.36.25 Python/3.14.6 Windows/11 script-exe/AMD64
Environment details (OS name and version, etc.)
Windows 11, x64