# AWS "ExpiredToken" on SES: Causes and Fix

Source: https://wraps.dev/ses/errors/expired-token

Why temporary AWS credentials expire mid-run, how SSO sessions and assumed roles differ, and how to refresh without restarting the job.

## The error

```
The security token included in the request is expired.
```

AWS exception `ExpiredTokenException`. The Wraps CLI reports it as `SESSION_TOKEN_EXPIRED`.

## Why this happens

The credentials were valid and have run out. Temporary credentials from SSO, an assumed role, or an instance or container role all carry an expiry, and AWS refuses any request signed with one past that point. Long-running jobs hit this in the middle rather than at the start.

-   An SSO session expired.
-   An assumed-role session reached the end of its duration.
-   Credentials were captured into environment variables once and never refreshed.
-   A job ran longer than the session duration it started with.

## How to fix it

1.  ### 1. Refresh the session
    
    For SSO, log in again. For an assumed role, re-run the assume-role step that produced the credentials.
    
    ```
    aws sso login
    ```
    
2.  ### 2. Stop freezing credentials into environment variables
    
    Exporting AWS\_ACCESS\_KEY\_ID, AWS\_SECRET\_ACCESS\_KEY and AWS\_SESSION\_TOKEN takes a snapshot the SDK can never refresh. Let the SDK resolve the profile instead, so it can renew on its own.
    
3.  ### 3. Raise the session duration for long jobs
    
    If a batch legitimately runs longer than the session, the role's maximum session duration is the setting to change, within whatever your organization permits.
    
4.  ### 4. Check the clock if it expires immediately
    
    A host clock far ahead of real time makes a fresh token look expired the moment it is issued.
    
    ```
    date -u
    ```
    

## How to stop it recurring

### Let the SDK own refresh

Credential providers renew temporary credentials on their own. Every mechanism that copies them out defeats that and reintroduces this error.

### Make long jobs resumable

A batch that cannot be resumed turns an expiry into lost work. One that checkpoints turns it into a refresh.

## Common questions

### How long do AWS temporary credentials last?

It depends on how they were issued. Assumed-role sessions run from 15 minutes up to the role's maximum duration, and SSO sessions are governed by the permission set. Neither is indefinite.

### Why did my token expire in the middle of a batch send?

Because the batch outlived the session it started with. Either the credentials were frozen into environment variables so nothing could refresh them, or the job runs longer than the session duration allows.

### Do I need new access keys after an ExpiredToken error?

No. Nothing is wrong with the underlying identity. Refresh the session and the same credentials work again.

## What Wraps does about this

The Wraps CLI maps ExpiredTokenException, TokenRefreshRequired and SSOTokenExpired to SESSION\_TOKEN\_EXPIRED and tells you to refresh rather than to reconfigure. That is the difference between a five-second fix and rotating keys you did not need to rotate.