The SSO session associated with this profile has expired or is otherwise invalid

Your IAM Identity Center session ended. Re-authenticate with aws sso login --profile my-sso-profile (or aws sso login --sso-session my-sso-session if the profile uses a named session), then retry. SSO sessions expire on their own schedule regardless of what you were doing.

The SSO session associated with this profile has expired or is otherwise invalid. Please run `aws sso login` to refresh your session.

Fix

1. Re-authenticate:

   aws sso login --profile my-sso-profile

   Expected: browser opens, you approve access, CLI prints a success message.

2. If your config uses a named sso-session block, refresh the session itself:

   aws sso login --sso-session my-sso-session

   Expected: same browser approval flow; all profiles sharing that session start working.

3. Verify:

   aws sts get-caller-identity --profile my-sso-profile

   Expected: your UserId, Account, and Arn as JSON.

When this applies

• The error names the SSO session as expired or invalid.
• You authenticate via AWS IAM Identity Center (formerly SSO), with sso_start_url in ~/.aws/config.

When it does NOT apply

• ExpiredToken without SSO wording: refresh STS/role credentials instead.
• aws configure sso is not a valid command: you are on CLI v1, upgrade to v2.
• The browser never opens on a headless box: use device-code flow or run aws sso login where you have a browser, then copy ~/.aws/sso/cache.

Compatibility

• AWS CLI v2 only. Requires an IAM Identity Center instance.

Why it happens

The SSO token cached in ~/.aws/sso/cache has a limited lifetime (often 8-12 hours, set by the Identity Center admin). Once it lapses, the CLI cannot mint role credentials for any profile tied to that session until you log in again.

Edge cases

• Multiple profiles can share one sso-session; refreshing the session fixes all of them at once.
• Adding sso_registration_scopes = sso:account:access to the session block enables automatic token refresh and cuts down on re-logins.
• Deleting ~/.aws/sso/cache forces a clean re-login if the cached token is corrupt.