SSO session expiration and re-login

[villelahdenvuo]

Describe the bug

I'm using AWS SSO to authenticate and aws-sdk-js-v3. When the SSO session expires it tells me to log in again with an error message, but even after repeating the aws sso login, the credentials still don't work.

Expected Behavior

The Node server is able to load credentials again and I can keep developing.

Current Behavior

The error message persists.

Reproduction Steps

1. I log in normally using aws sso login --profile developer
2. I start my Node.js server: AWS_PROFILE=developer node server.js
3. I keep developing my app until my SSO session expires
4. aws-sdk-js-v3 throws an error:

CredentialsProviderError: The SSO session associated with this profile has expired. To refresh this SSO session run aws sso login with the corresponding profile

5. I login again aws sso login --profile developer
6. Same error is thrown again when I try to call some aws-sdk-js-v3 command.

Possible Solution

No response

Additional Information/Context

I opened my .aws/sso/cache/xxx.json file and notice that the accessToken is updated however the expiresAt property is not updated even after a new aws sso login call.

If I wait more time and run aws sso login again it finally updates the expiresAt property.

It seems that this is a likely reason for the issue I'm having. It seems like there is some mismatch with different expirations.

CLI version used

aws-cli/2.8.2 Python/3.10.7 Darwin/21.6.0 source/arm64 prompt/off

Environment details (OS name and version, etc.)

MacOS

[tim-finnigan]

Hi @villelahdenvuo thanks for reaching out. Per this documentation: "Each time a user signs in to IAM Identity Center, a sign in session is created with an 8-hour lifetime."

Regarding what you said here:

If I wait more time and run aws sso login again it finally updates the expiresAt property.

How much more time do you have to wait in this scenarios?

[michelleparent]

I'm also seeing the same issue as @villelahdenvuo. accessToken gets updated, but expiresAt does not after running aws sso login --profile <>. A second run of the command updated the expiresAt property. This was tested within a 10 minute window.

[tim-finnigan]

@michelleparent which version of the AWS CLI are you using? There was a recent issue involving SSO and it looks like the issue creator was also using v2.8.2 like @villelahdenvuo.

I recommend updating to the latest version (currently 2.8.6 per the CHANGELOG) and let us know if you're still seeing the issue.