AWS: The security token included in the request is expired
The temporary credentials issued by STS have passed their expiry, which is one hour by default for an assumed role. A long build, a laptop resumed from sleep with a stale cache, or a clock that has drifted by more than a few minutes all produce it even though credentials are clearly present.
Quick fix
Read the commands before running them. Anything that restarts a service, deletes data or changes permissions should be tried on a non-production system first.
# Who am I, and does anything work at all?
aws sts get-caller-identity
# SSO sessions expire on their own schedule
aws sso login --profile prod
# Assumed roles: ask for a new session, up to the role's maximum
aws sts assume-role --role-arn arn:aws:iam::111122223333:role/deploy \
--role-session-name ci --duration-seconds 3600
# Clock skew gives the same message with perfectly valid credentials
timedatectl status
sudo chronyc makestep
# Long jobs: let the SDK's credential provider refresh, rather than
# copying keys into environment variables once at the startHow to diagnose Cloud errors
Cloud provider errors are overwhelmingly one of two things: IAM (the caller is not permitted, or the credentials are not the ones you think) or quota (the account limit was reached). Providers deliberately return the same vague AccessDenied for a missing permission, a deny in a boundary or SCP, and a resource policy that excludes you, so the fix begins with identifying which identity made the call.
If the quick fix above does not resolve it, work through these steps. They apply to this whole class of error, not just to this one message, which is usually what saves the time.
- Confirm the identity first:
aws sts get-caller-identity,az account show, orgcloud auth list. An unexpectedly large share of AccessDenied errors are the right policy on the wrong principal. - Use the provider's policy simulator (IAM Policy Simulator,
gcloud policy-troubleshoot) rather than reading policy JSON. It accounts for boundaries, SCPs and resource policies that are invisible in a single document. - Check CloudTrail / Activity Log / Cloud Audit Logs for the denied call. The log entry names the exact action and resource ARN, which the client-side error usually omits.
- For quota errors, look up the current limit and the current usage before requesting an increase: many quotas are per-region and per-account, and the resource you think is idle may be counted.
- Verify the region. A resource that "does not exist" very often exists in a different region than the one your CLI profile defaults to.
Tools worth reaching for
aws sts get-caller-identityIAM Policy Simulatorgcloud policy-troubleshootCloudTrail / Activity Log
Authoritative references
Primary documentation for this error, worth reading before applying any fix in production.
Related Cloud errors
- AWS CloudFormation: Stack is in ROLLBACK_COMPLETE state and can not be updatedThe stack's first create failed and rolled back. A stack in that state has no resources and…
- AWS EC2: Instance limit exceededAccount has reached the limit for number of instances of a specific type in a region.
- AWS ECS: CannotPullContainerError, pull image manifest has been retriedThe task could not fetch its image, and the reason is far more often networking than…
- AWS IAM: Policy syntax errorIAM policy JSON is malformed or contains invalid actions, resources, or conditions.
- AWS Lambda: Function timeoutLambda function exceeded maximum execution time. Default is 3 seconds, max is 15 minutes.
- AWS RDS: Connection timeoutCannot connect to RDS instance. Security group blocking, wrong endpoint, or instance not…
- AWS S3: Access DeniedIAM permissions insufficient to access S3 bucket. Bucket policy, ACL, or IAM policy blocking…
- AWS S3: PermanentRedirect, wrong regional endpointThe request went to the wrong regional endpoint. S3 bucket names are global but buckets live…
Browse other categories
- HTTP 494xx client errors, 5xx server errors, redirects, headers and protocol problems.
- JavaScript 42npm resolution, async pitfalls, hydration, memory limits and runtime type…
- Database 41Connections, deadlocks, constraints, replication and memory limits.
- AI 35Rate limits, context windows, GPU memory and model-serving failures.
- Network 35Refused connections, timeouts, resets, MTU problems and port exhaustion.
- Python 35Imports, virtual environments, encoding, concurrency and dependency conflicts.
- Kubernetes 34CrashLoopBackOff, ImagePullBackOff, OOMKilled, RBAC, scheduling and storage.
- Docker 27Daemon connectivity, disk space, image pulls, ports and architecture mismatches.
- System 26Disk space, systemd units, file descriptors, OOM killer and scheduled jobs.
- Security 25JWT validation, CSRF, OAuth grants, SELinux, SSH host keys and CSP.
- TLS 24Untrusted authorities, expiry, hostname mismatch, chains and cipher negotiation.
- Frontend 23Hydration mismatches, bundler resolution, layout shift and font loading.
Something missing or wrong?
This entry is maintained by hand. If the fix is out of date, incomplete, or you have a better one, email a correction and it will be reviewed.