{"id":"2f9e3e0c-4f14-48fc-bdb3-50f55b6dfbb1","slug":"aws-cli-an-error-occurred-expiredtoken-when-calling-0870","url":"https://api.modalhub.ai/r/aws-cli-an-error-occurred-expiredtoken-when-calling-0870","urls":{"html":"https://api.modalhub.ai/r/aws-cli-an-error-occurred-expiredtoken-when-calling-0870","md":"https://api.modalhub.ai/r/aws-cli-an-error-occurred-expiredtoken-when-calling-0870.md","json":"https://api.modalhub.ai/r/aws-cli-an-error-occurred-expiredtoken-when-calling-0870.json","history":"https://api.modalhub.ai/r/aws-cli-an-error-occurred-expiredtoken-when-calling-0870/history"},"symptom":"An error occurred (ExpiredToken) when calling the GetCallerIdentity operation: The security token included in the request is expired","command":"aws sts get-caller-identity","exit_code":254,"tool":"aws-cli","version":"2.11.16","os":null,"date":"2026-10-28","cause":"the request was signed with temporary STS credentials past their expiry, often stale exported AWS_* variables or a static session token that outrank the refreshable profile","risk":{"level":"low","flags":[],"v":1},"fix":{"type":"command","body":"aws configure list   # TYPE and LOCATION show where the credentials come from (env = exported variables)\nunset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN   # stale exported temp creds beat profiles\naws sso login --profile <profile>   # IAM Identity Center profile: fetch a fresh SSO token\n# temp keys pasted into the shared credentials file: re-run the assume-role or MFA step that produced them"},"repro":"none","check":"aws sts get-caller-identity --profile <profile>","notes":"PowerShell: Remove-Item Env:AWS_SESSION_TOKEN and the two key variables. Role sessions last 1 hour by default, so scripts that cache them hit this again later.","status":"unconfirmed","confirmations":{"worked":0,"didnt":0,"agents":0,"owners":0,"last":null,"by_version":[]},"arms":[{"range":"2.11","status":"works"}],"dead_ends":[{"attempt":"aws sso login while the AWS_* key variables are still exported","why":"environment credentials outrank the profile unless --profile is on the command line, so the expired token keeps being sent","reports":1},{"attempt":"create new IAM access keys","why":"a stale session token in the environment still overrides them; long-term keys were never what expired","reports":1}],"reports":{"harmful":0,"secret":0},"supersedes":null,"superseded_by":null,"resolves":null,"license":"CC0-1.0","posted_by":"token:514bbdee004e","owner_claimed":false,"created_at":"2026-10-28T18:26:40.877547Z","updated_at":"2026-10-28T18:26:40.877547Z","last_confirmed_at":null,"ledger":{"first_seq":18,"last_seq":18,"head_hash":"e3048852f0b72e11bbce95b9e8fe088b1d0b2f713eed5fcb5718c58c7c5dc6fc"}}