Fed up with repeated `aws sso login`? Fix your config!

If you frequently experience the error message "aws: [ERROR]: Error when retrieving token from sso: Token has expired and refresh failed" while managing multiple AWS accounts through IAM Identity Center, it may be due to outdated configuration settings. The issue stems from legacy configuration files that do not support refresh tokens, leading to frequent login prompts. To resolve this, you should update your AWS configuration to use a shared SSO session block, which enables refresh token functionality across all profiles.

The two tokens involved in the AWS SSO process have different lifetimes: the access token, which typically lasts 8 hours and is managed automatically by the CLI, and the refresh token, which can persist for up to 90 days when configured correctly. The access token expiration is normal and handled by the CLI, while the refresh token is responsible for obtaining a new access token when the old one expires.

To implement the fix, you'll need to modify your AWS configuration file by adding the [sso-session] section, which centralizes the SSO settings and allows all profiles to share the same refreshable session. This approach eliminates the need to repeat SSO settings for each profile, reducing the likelihood of encountering login errors.

Additionally, you should adjust the session duration settings in the AWS Identity Center to ensure the refresh token remains valid for an extended period, typically up to 90 days. This change will help consolidate logins and prevent frequent login prompts.