aws / aws/aws-cli

aws login - no refresh?

Open
#10,628 0 comments 0 reactions 0 assignees View on GitHub
bug needs-triage
Dominant language
Python
Stars
17.3k
Forks
4.6k
Avg merge
1d 2h
Merged PRs (30d)
13

Description

### Describe the bug

The documentation of `aws login` claims that the tokens will be automatically refreshed:
* "Each time the `login` command is called, the CLI will acquire temporary credentials and a refresh token that correspond to your selected console session. The CLI will refresh the temporary credentials automatically as long as the refresh token is valid." (https://docs.aws.amazon.com/cli/latest/reference/login/#description)
* "[...] this will automatically generate temporary credentials. The CLI will automatically refresh these credentials for up to 12 hours." (https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sign-in.html)
* "The AWS CLI and SDKs will automatically refresh the cached credentials every 15 minutes as needed. The overall session will be valid for up to the set session duration of the IAM principal (maximum of 12 hours), after which you must run `aws login` again." (https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sign-in.html#cli-configure-sign-in-with-profile)

However, it is unclear to me how that automatic refresh is happening. There is no systemd user service or even a background process, as far as I can see, that could accomplish this.

The resulting effect I see is that the tokens expire constantly, every few minutes (<<1h) I have to run `aws login` again.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Expected Behavior

* Documentation on how to control the background process that keeps refreshing the tokens, preferably using a systemd user service.
* Documentation how to manually trigger a token refresh, in case the automatic background process does not work, allowing people to set up systemd user timers themselves.

### Current Behavior

* I cannot find documentation on how the automatic token refresh is being executed.
* I cannot find documentation on how to refresh the token manually.
* The token refresh does not appear to work: Tokens expire constantly in <<1h and I have to `aws login` again.

### Reproduction Steps

`aws login`, wait for significantly less than 1h, run an `aws` command, notice that tokens are expired, run `aws login` again, repeat

### Possible Solution

Both should provided:
* Documentation on how to control the background process that keeps refreshing the tokens, preferably using a systemd user service.
* Documentation how to manually trigger a token refresh, in case the automatic background process does not work, allowing people to set up systemd user timers themselves.

### Additional Information/Context

_No response_

### CLI version used

aws-cli/2.36.0 Python/3.14.6 Linux/7.1.6-201.fc44.x86_64 source/x86_64.fedora.44

### Environment details (OS name and version, etc.)

aws-cli/2.36.0 Python/3.14.6 Linux/7.1.6-201.fc44.x86_64 source/x86_64.fedora.44

Contributor guide

Open the contributing guide

Research direction

Start with the `aws login` entry point, reproduce the reported expiry using the command sequence in the issue, and compare the linked AWS CLI documentation with the observed behavior. Done means documenting how automatic refresh works, how to trigger it manually, and how users can control or work around it when refresh fails.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cli, cloud, documentation
Issue type
Documentation
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.