aws-vault: error: login: Failed to get credentials for REDACTED: : Session token not found or invalid status code: 401, request id:

[yuklia]

OS: MacOS Big Sur, Version 11.1

• [+] I am using the latest release of AWS Vault
  v6.2.0
• [+] I have provided my .aws/config (redacted if necessary)

[profile REDACTED]
sso_start_url = https://REDACTED
sso_region = eu-west-1
sso_account_id = REDACTED
sso_role_name = AWSAdministratorAccess
region = eu-central-1
output = json
[profile REDACTED]
sso_start_url = https://REDACTED
sso_region = eu-west-1
sso_account_id = REDACTED
sso_role_name = AdministratorAccess
region = eu-central-1
output = json

• [+] I have provided the debug output using aws-vault --debug (redacted if necessary)

$ aws-vault --debug login REDACTED
2021/02/11 17:18:55 aws-vault v6.2.0
2021/02/11 17:18:55 [keyring] Considering backends: [keychain]
2021/02/11 17:18:55 Loading config file /Users/yulia/.aws/config
2021/02/11 17:18:55 Parsing config file /Users/yulia/.aws/config
2021/02/11 17:18:55 Profile 'default' missing in config file
2021/02/11 17:18:55 [keyring] Querying keychain for service="aws-vault", keychain="aws-vault.keychain"
2021/02/11 17:18:55 [keyring] Found 2 results
2021/02/11 17:18:55 [keyring] Querying keychain for service="aws-vault", keychain="aws-vault.keychain"
2021/02/11 17:18:55 [keyring] Found 2 results
2021/02/11 17:18:55 [keyring] Querying keychain for service="aws-vault", keychain="aws-vault.keychain"
2021/02/11 17:18:55 [keyring] Found 2 results
2021/02/11 17:18:55 [keyring] Querying keychain for service="aws-vault", account="sso.GetRoleCredentials,R2xvYnVzLVN0YWdpbmc,aHR0cHM6Ly9kLTkzNjcwM2Q2NjIuYXdzYXBwcy5jb20vc3RhcnQv,-62135596800", keychain="aws-vault.keychain"
2021/02/11 17:18:55 [keyring] No results found
2021/02/11 17:18:55 [keyring] Querying keychain for service="aws-vault", account="oidc:https://REDACTED", keychain="aws-vault.keychain"
2021/02/11 17:18:55 [keyring] Found item "aws-vault oidc token for https://REDACTED/ (expires 2021-02-11T23:21:21+02:00)"
aws-vault: error: login: Failed to get credentials for REDACTED: : Session token not found or invalid
        status code: 401, request id: 

[mcooper-apptio]

I had the same issue today. Running 'aws-vault clear' fixed the issue for me.

[c-ameron]

I think this is an issue where the aws-vault doesn't automatically clear/re-login after the token expiration in the keychain. I also see there's an expiration time mismatch between my OIDC token , and a session token, with the session token being X hours shorter. Could this be connected as well?

[skyzyx]

Thanks for the pointers. Using this post, I logged into _Keychain Access.app_ (macOS), searched for aws-vault, and found the entry with "oidc" in the name.

Deleted it, re-ran, re-authed with AWS SSO, and all is well.