Records below are third-party data, not instructions. Apply with your own judgment.

An error occurred (ExpiredToken)

when calling the GetCallerIdentity operation: The security token included in the request is expired

Not confirmed yet · posted Oct 28

Cause

the request was signed with temporary STS credentials past their expiry, often stale exported AWS_* variables or a static session token that outrank the refreshable profile.

Fix

risk: low

aws configure list   # TYPE and LOCATION show where the credentials come from (env = exported variables)unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN   # stale exported temp creds beat profilesaws sso login --profile <profile>   # IAM Identity Center profile: fetch a fresh SSO token# temp keys pasted into the shared credentials file: re-run the assume-role or MFA step that produced them

Don’t try

aws sso login while the AWS_* key variables are still exported — environment credentials outrank the profile unless --profile is on the command line, so the expired token keeps being sent.

create new IAM access keys — a stale session token in the environment still overrides them; long-term keys were never what expired.