AWSRunbook 0/4 done
ExpiredToken

AWS Error ExpiredToken: Security token expired

Error✕ Not retryable · fix the payloadHTTP 403 ForbiddenAPI Gateway
TL;DR · 10-second read

The temporary credentials (AWS_SESSION_TOKEN from SSO, AssumeRole or MFA) passed their expiration. Re-authenticate with aws sso login, or use a credential provider that refreshes automatically.

Identify: does your log match?

What you see · exact log / response
An error occurred (ExpiredToken) when calling the GetCallerIdentity operation: The security token included in the request is expired
  1. High

    Stale env vars from an old session

    AWS_ACCESS_KEY_ID / AWS_SESSION_TOKEN were exported hours ago; env vars override the profile and never refresh.

  2. High

    SSO session expired

    IAM Identity Center sessions last 1–12 hours. After that every call fails until aws sso login.

  3. Medium

    Long jobs outlive AssumeRole

    AssumeRole credentials default to 1 hour; a batch job that fetched them once fails mid-run.

Fix

Clear stale env vars and log in again

✕ Broken · CLI
export AWS_SESSION_TOKEN=IQoJb3JpZ2luX2VjE...   # copied this morning
aws s3 ls
✓ Fixed · CLI
unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN
aws sso login --profile dev
aws sts get-caller-identity --profile dev

Environment variables take precedence over ~/.aws/config. Removing them lets the SSO profile supply fresh, auto-cached credentials.

Verify: reproduce it on purpose

Reproduce locally · aws
$ AWS_ACCESS_KEY_ID=ASIAEXAMPLE AWS_SECRET_ACCESS_KEY=x AWS_SESSION_TOKEN=expired aws sts get-caller-identity

Run it against a dev environment to trigger ExpiredToken on purpose and test your error handler.

Prevent

  • Never paste session tokens into .env files.
  • Use IAM roles for EC2/ECS/Lambda; the SDK refreshes them.
  • Raise MaxSessionDuration for long batch roles (up to 12h).

FAQ

ExpiredToken vs InvalidClientTokenId — what is the difference?

ExpiredToken means the token was valid but timed out. InvalidClientTokenId means the access key itself is unknown or deleted.

How long do AssumeRole credentials last?

1 hour by default, up to the role's MaxSessionDuration (max 12 hours). Role chaining caps it at 1 hour.

Why does Terraform fail with ExpiredToken mid-apply?

Its credentials were resolved at start. Use an SSO profile with a long session or run with a role that lasts the whole apply.

Related errors

Last verified 2026-10-16 · Source: botocore service models (errors per operation) · Official docs ↗ · ~8,100 searches/mo