The error
The security token included in the request is expired.AWS exception ExpiredTokenException. The Wraps CLI reports it as SESSION_TOKEN_EXPIRED.
Why this happens
The credentials were valid and have run out. Temporary credentials from SSO, an assumed role, or an instance or container role all carry an expiry, and AWS refuses any request signed with one past that point. Long-running jobs hit this in the middle rather than at the start.
- An SSO session expired.
- An assumed-role session reached the end of its duration.
- Credentials were captured into environment variables once and never refreshed.
- A job ran longer than the session duration it started with.
How to fix it
1. Refresh the session
For SSO, log in again. For an assumed role, re-run the assume-role step that produced the credentials.
aws sso login2. Stop freezing credentials into environment variables
Exporting AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN takes a snapshot the SDK can never refresh. Let the SDK resolve the profile instead, so it can renew on its own.
3. Raise the session duration for long jobs
If a batch legitimately runs longer than the session, the role's maximum session duration is the setting to change, within whatever your organization permits.
4. Check the clock if it expires immediately
A host clock far ahead of real time makes a fresh token look expired the moment it is issued.
date -u
How to stop it recurring
Let the SDK own refresh
Credential providers renew temporary credentials on their own. Every mechanism that copies them out defeats that and reintroduces this error.
Make long jobs resumable
A batch that cannot be resumed turns an expiry into lost work. One that checkpoints turns it into a refresh.
Common questions
How long do AWS temporary credentials last?
It depends on how they were issued. Assumed-role sessions run from 15 minutes up to the role's maximum duration, and SSO sessions are governed by the permission set. Neither is indefinite.
Why did my token expire in the middle of a batch send?
Because the batch outlived the session it started with. Either the credentials were frozen into environment variables so nothing could refresh them, or the job runs longer than the session duration allows.
Do I need new access keys after an ExpiredToken error?
No. Nothing is wrong with the underlying identity. Refresh the session and the same credentials work again.
What Wraps does about this
The Wraps CLI maps ExpiredTokenException, TokenRefreshRequired and SSOTokenExpired to SESSION_TOKEN_EXPIRED and tells you to refresh rather than to reconfigure. That is the difference between a five-second fix and rotating keys you did not need to rotate.