aws login refresh fails after ~10 minutes with CreateOAuth2Token INVALID_REQUEST
- Dominant language
- Python
- Stars
- 17.3k
- Forks
- 4.6k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 13
Description
### Describe the bug
When performing long-running AWS CLI operations using `aws login`, authentication begins failing after approximately 10–11 minutes.
The initial login succeeds and AWS CLI operations work normally until the cached login credential requires refresh. At that point, subsequent commands fail during `CreateOAuth2Token` with:
```text
An error occurred (ValidationException) when calling the CreateOAuth2Token operation:
The provided authorization grant is invalid, expired, revoked, or malformed
error: INVALID_REQUEST
```
This appears very similar to the previously reported and now-closed issue #10267:
https://github.com/aws/aws-cli/issues/10267
However, I have reproduced the behavior using multiple AWS login regions, so the current issue does not appear to be region-specific.
The problem is reproducible independently of any application or deployment script by repeatedly invoking `aws sts get-caller-identity` after a successful `aws login`. The failure consistently occurs approximately 10–11 minutes after login.
**NOTE:** The issue is currently reproducible on `aws-cli/2.36.36 Python/3.14.6 Windows/10 script-exe/AMD64`. It was originally detected on `aws-cli/2.36.27 Python/3.14.6 Windows/10 script-exe/AMD64`.
### Regression Issue
- [ ] Select this option if this issue appears to be a regression.
### Expected Behavior
After a successful `aws login`, AWS CLI commands should continue to authenticate successfully for the duration of the login session.
When the short-lived login credentials expire, the AWS CLI should automatically refresh them using the cached login session without requiring the user to run `aws login` again or interrupting long-running CLI operations.
### Current Behavior
After approximately 10–11 minutes following a successful `aws login`, AWS CLI commands begin failing when the CLI attempts to refresh the login credentials.
The refresh attempt fails with:
```text
An error occurred (ValidationException) when calling the CreateOAuth2Token operation:
The provided authorization grant is invalid, expired, revoked, or malformed
Additional error details:
error: INVALID_REQUEST
```
Running `aws login` again restores access temporarily, but the same failure recurs approximately 10–11 minutes later.
### Reproduction Steps
1. Log in using an AWS CLI login profile:
```powershell
aws login --profile example-profile --region us-east-2
```
2. Complete the browser-based login.
3. Run the following PowerShell script. It invokes `sts get-caller-identity` every 30 seconds until the AWS CLI returns a failure, then reports the elapsed time:
```powershell
$start = Get-Date
while ($true) {
Get-Date
aws sts get-caller-identity --profile example-profile --no-cli-pager
if ($LASTEXITCODE -ne 0) {
break
}
Start-Sleep -Seconds 30
}
$elapsed = (Get-Date) - $start
Write-Host "Failure after $($elapsed.TotalMinutes) minutes."
```
4. Observe that `get-caller-identity` initially succeeds on each invocation.
5. After approximately 10–11 minutes, observe that the command fails when AWS CLI attempts to refresh the login credentials:
```text
aws: [ERROR]: An error occurred (ValidationException) when calling the CreateOAuth2Token operation: The provided authorization grant is invalid, expired, revoked, or malformed
Additional error details:
error: INVALID_REQUEST
```
The issue has been reproduced using multiple AWS login regions.
### Possible Solution
_No response_
### Additional Information/Context
_No response_
### CLI version used
aws-cli/2.36.36 Python/3.14.6 Windows/10 script-exe/AMD64
### Environment details (OS name and version, etc.)
Microsoft Windows 10.0.19045, Powershell 7.6.5
Contributor guide
Assessment
This issue has not been assessed yet.