Problem with credentials when working with AWS CLI commands

Note that your CloudShell session starts with the credentials with which you're logged in when launching CloudShell in the console. Normally, you wouldn't want to input any separate credentials in the CloudShell session, unless you specifically want to access a different account or role, for example, from inside the CloudShell session.

If you simply launch CloudShell and type a command, like aws s3api list-buckets, without running "aws configure" or any "export" statements to set credentials, the CLI will operate under the credentials that you used to launch CloudShell.

It appears you're encountering an issue with expired credentials when using AWS CLI commands. This is a common problem that can occur for several reasons. Let's address this step by step:

1. IAM User Credentials vs. IAM Identity Center (SSO): Your error message mentions SSO (Single Sign-On), but you've configured the CLI with IAM user credentials. These are two different authentication methods. If your organization uses IAM Identity Center (formerly AWS SSO), you should use the appropriate SSO login process instead of configuring with IAM user credentials.

2. Temporary Credentials: If you're using IAM Identity Center, the credentials you receive are temporary and will expire after a set period (usually between 1 to 12 hours). You need to refresh these credentials regularly.

3. CloudShell Specific Issues: If you're using CloudShell, credential issues can occur if your AWS Console session has expired while your CloudShell environment is still running. In this case, refreshing the webpage might resolve the issue.

4. EC2 Instance Credentials: For EC2 instances, make sure you're using the correct method to provide credentials. The best practice is to use IAM roles attached to the EC2 instance rather than configuring with user credentials.

To resolve this issue:

1. If you're using IAM Identity Center (SSO):

   • Run aws sso login --profile your-profile-name to refresh your credentials.
   • Ensure your AWS CLI is up to date, as older versions may have issues with SSO.

2. If you're using IAM User credentials:

   • Verify that the credentials you've configured are still valid and have not been revoked or expired.
   • Run aws configure again to update your credentials if necessary.

3. For CloudShell:

   • Try refreshing the webpage to start a new session.
   • If the issue persists, it could be due to lack of permissions or operational issues with CloudShell.

4. For EC2 instances:

   • Consider using IAM roles instead of configuring with user credentials.
   • If you must use user credentials, ensure they are up to date and have the necessary permissions.

Remember, it's crucial to keep your AWS CLI updated to the latest version to avoid known issues and benefit from the latest features and fixes. If you continue to experience issues after trying these steps, you may need to contact AWS Support for further assistance.
Sources
Resolve the IAM credentials error "The security token isn’t valid” | AWS re:Post
Problems configuring credentials for AWS CLI | AWS re:Post
Getting IAM Identity Center user credentials for the AWS CLI or AWS SDKs - AWS IAM Identity Center
Troubleshooting AWS CloudShell - AWS CloudShell

Error when retrieving token from sso

The sso part is significant, I'm guessing you're logging in to your organisation's AWS account having previously federated using something like Azure AD.

I first ran "aws configure" and used the user IAM security credentials.

Another guess - did you get these security credentials from clicking Access keys on the AWS SSO login screen (where the name of the account in under the red block, account number in green and account email in blue)?

These credentials are time-limited - according to this page (which is ancient) they're valid for up to 60 minutes https://aws.amazon.com/blogs/security/aws-single-sign-on-now-enables-command-line-interface-access-for-aws-accounts-using-corporate-credentials/

Try federating again and getting yourself a new set.

Or follow the updated method at https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html