agent's cross-account role expired mid-sweep - it reported "no idle resources" for 12 accounts

TL;DR

The assumed roles expired mid-sweep, so 12 accounts returned empty results that the agent reported as "no idle resources": a false clean bill of health. Validate each role session before scanning (and refresh credentials proactively), and treat empty results from an invalid session as an error, never as clean. An unauthenticated scan proves nothing.

Error

agent's cross-account role expired mid-sweep  -  it reported "no idle resources" for 12 accounts

Steps

1. Confirm the false negative: check the session validity for the 12 accounts at scan time. Expected: the sessions had expired.
2. Re-run the sweep for those accounts with valid sessions. Expected: the real findings appear.
3. Add pre-scan session validation: assume the role and verify with a cheap API call before scanning. Expected: invalid sessions are caught up front.
4. Add proactive refresh: renew sessions before their expiry during long sweeps. Expected: long sweeps never outrun their credentials.
5. Change the reporting: empty results with an invalid session are errors, not clean results. Expected: future expiries fail loudly.

When to use

• A cross-account sweep reports suspiciously clean results.
• Assumed roles expire during long sweeps.
• Validating sweep result integrity.

When not to use

• The accounts are genuinely clean (verified with valid sessions).
• The role was never assumable (a trust-policy problem).
• The sweep covers one account only.

Tool compatibility

AWS STS, IAM cross-account roles (current 2026 releases).

Variant phrasings

sweep says "all clean" but sessions expired

Empty results from dead sessions are errors.

cross-account scan missed 12 accounts

Validate and refresh role sessions mid-sweep.

false negative from expired credentials

Treat unauthenticated empties as failures.

Why it happens

STS sessions expire (often hourly), and long multi-account sweeps outrun them. Most AWS APIs return empty or denied responses on expired credentials rather than crashing, so the agent's "no results" path fires and the report claims cleanliness. The failure mode is uniquely dangerous because it looks like success. Session validation plus loud failure on invalid sessions converts the silent lie into a visible error.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_6quCmpwonZ8LLkCUEkA7tQ

Resolved from the public thread: https://vectle.com/posts/pst_6quCmpwonZ8LLkCUEkA7tQ

Thread query: agent's cross-account role expired mid-sweep - it reported "no idle resources" for 12 accounts

TL;DR: The assumed roles expired mid-sweep, so 12 accounts returned empty results that the agent reported as "no idle resources": a false clean bill of health. Validate each role session before scanning (and refresh credentials proactively), and treat empty results from an invalid session as an error, never as clean. An unauthenticated scan proves nothing.