Requirement Summary:
Developer uses AWS IAM Identity Center (SSO) with AWS CLI / SDKs
Initially working fine
Now receiving AccessDenied errors
No changes to config or scripts
Key Understanding:
IAM Identity Center credentials are temporary and time-limited. When you use SSO-based access via the AWS CLI (aws sso login), it obtains temporary credentials stored in the local cache.
By default, these expire in 1 hour (can be extended).
Evaluate Options:
A. Permissions to CLI binary changed
Unlikely – this would produce execution errors, not AccessDenied from AWS API
B. Permission set lacks required permissions
Then the error would have occurred from the beginning, not after time
C. IAM Identity Center credentials expired
Most likely – user hasn ' t refreshed credentials using aws sso login again
After expiration, API calls fail with AccessDenied
D. Developer is calling the wrong AWS account
Would likely show different types of errors (AccountNotFound, etc.)
SSO and AWS CLI: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html
Troubleshooting SSO CLI: https://docs.aws.amazon.com/cli/latest/userguide/sso-configure-profile-token.html