Fix AWS CLI ExpiredToken by refreshing the right credentials

An AWS command worked earlier but now returns ExpiredToken. Editing the access key in a random configuration file can leave the CLI using a different credential source entirely.

Why this happens

Temporary credentials expire. Environment variables, profiles and role-based providers can take precedence in ways that make an outdated credential set remain active.

Step-by-step solution

1. Inspect which profile and credential source the command uses without printing secret values. Confirm the selected account and role with a safe identity check.

2. Refresh the intended SSO or assumed-role session through its supported workflow. Remove stale environment overrides only after identifying them.

3. Run the same command with an explicit profile where appropriate. Check the local clock if signature-related errors persist.

Worked example

aws sts get-caller-identity --profile your-profile is a read-only way to confirm the effective identity. Replace your-profile with the intended configured profile; do not paste secret keys into the command history.

Verify the fix

The refreshed identity should match the expected account and role, and the original operation should work if that role is authorised. Authentication success does not grant missing permissions.

Prevent a repeat

Prefer short-lived role credentials and document the credential source used by automation. Avoid copying temporary credentials into long-lived deployment files.

Reference

Official documentation or standards guidance

An original Gistmax troubleshooting guide. Scenarios and sample values are illustrative; configuration depends on your software version and environment. Cover diagram: Gistmax Tutorials.