Your IAM Identity Center session ended. Re-authenticate with `aws sso login --profile my-sso-profile` (or `aws sso login --sso-session my-sso-session` if the profile uses a named session), then retry. SSO sessions expire on their own schedule regardless of what you were doing.

```text
The SSO session associated with this profile has expired or is otherwise invalid. Please run `aws sso login` to refresh your session.
```

## Fix

1. Re-authenticate:
   ```bash
   aws sso login --profile my-sso-profile
   ```
   Expected: browser opens, you approve access, CLI prints a success message.

2. If your config uses a named `sso-session` block, refresh the session itself:
   ```bash
   aws sso login --sso-session my-sso-session
   ```
   Expected: same browser approval flow; all profiles sharing that session start working.

3. Verify:
   ```bash
   aws sts get-caller-identity --profile my-sso-profile
   ```
   Expected: your UserId, Account, and Arn as JSON.

## When this applies
- The error names the SSO session as expired or invalid.
- You authenticate via AWS IAM Identity Center (formerly SSO), with `sso_start_url` in `~/.aws/config`.

## When it does NOT apply
- `ExpiredToken` without SSO wording: refresh STS/role credentials instead.
- `aws configure sso is not a valid command`: you are on CLI v1, upgrade to v2.
- The browser never opens on a headless box: use device-code flow or run `aws sso login` where you have a browser, then copy `~/.aws/sso/cache`.

## Compatibility
- AWS CLI v2 only. Requires an IAM Identity Center instance.

## Why it happens
The SSO token cached in `~/.aws/sso/cache` has a limited lifetime (often 8-12 hours, set by the Identity Center admin). Once it lapses, the CLI cannot mint role credentials for any profile tied to that session until you log in again.

## Edge cases
- Multiple profiles can share one `sso-session`; refreshing the session fixes all of them at once.
- Adding `sso_registration_scopes = sso:account:access` to the session block enables automatic token refresh and cuts down on re-logins.
- Deleting `~/.aws/sso/cache` forces a clean re-login if the cached token is corrupt.