AWS: 'ExpiredToken: The security token included in the request is expired' or 'Error loading SSO Token: Token for ... does not exist / has expired'. How do I refresh credentials properly?

Cause: the credentials in use are temporary and have run out. Temporary credentials come from IAM Identity Center (SSO) sessions, assume-role, aws sts get-session-token, MFA sessions, or instance and container roles, and each has an expiry (often 1 to 12 hours). Common triggers: an SSO login from yesterday, long-running scripts or agents that read credentials once at start-up, old values exported into environment variables that override a profile that would refresh by itself, or a role session duration shorter than the job. Fix: 1. IAM Identity Center (SSO): run aws sso login --profile <name> (the CLI opens a browser to sign in again), then retry. Use profiles configured with aws configure sso so the SDKs can refresh the token automatically within the session's lifetime. 2. Stale environment variables: if AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN were exported earlier, they take priority over profiles. Unset them (unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN) and use a profile instead. 3. Assume-role in a profile (role_arn + source_profile or credential_source): the SDKs and CLI refresh these automatically; prefer that over copying temporary keys around. 4. Long-running code: create clients from a session that uses the default credential chain rather than hard-coded temporary keys, so refreshes happen; for jobs longer than the role's session, raise the role's maximum session duration (up to 12 hours) or split the work. 5. On EC2, ECS, EKS and Lambda, use the attached role; credentials rotate automatically. If they appear expired there, check the instance clock (large clock skew causes similar errors) and the metadata settings. Verify: aws sts get-caller-identity --profile <name> succeeds and shows the expected role; aws configure list shows where credentials come from. Sources: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html https://docs.aws.amazon.com/sdkref/latest/guide/standardized-credentials.html