dbt-labs / dbt-labs/dbt-adapters

[Bug] dbt-athena: AssumeRole credentials expire mid-run for long-lived AWS clients

Open
#1,997 0 comments 0 reactions 0 assignees View on GitHub
triage:product type:bug
Dominant language
Python
Stars
233
Forks
362
Avg merge
3d 22h
Merged PRs (30d)
9

Description

### Is this a new bug?

- [x] I believe this is a new bug
- [x] I have searched the existing issues, and I could not find an existing issue for this bug

### Which packages are affected?

- [ ] dbt-adapters
- [ ] dbt-tests-adapter
- [x] dbt-athena
- [ ] dbt-athena-community
- [ ] dbt-bigquery
- [ ] dbt-postgres
- [ ] dbt-redshift
- [ ] dbt-snowflake
- [ ] dbt-spark

### Current Behavior

`_get_assume_role_session` (introduced in #1657) builds a `boto3.Session` from **static** key/secret/token values returned by `sts:AssumeRole`, and rotates the cached session via an `lru_cache` TTL bucket.

Rotating the session reference does not help clients that already hold one: a client built from a previously-cached session keeps the stale static credentials, and boto3 has no hook to refresh them. After the AssumeRole TTL elapses, any long-lived AWS client surfaces `ExpiredTokenException` mid-run.

### Expected Behavior

Credentials should refresh transparently for the life of the session, so clients derived from it keep working without the caller juggling TTLs. `botocore.credentials.RefreshableCredentials` provides exactly this via a `refresh_using` callable that re-invokes `sts:AssumeRole` in place.

### Steps To Reproduce

1. Configure a dbt-athena profile with `assume_role_arn` set and default `assume_role_duration_seconds` (3600).
2. Run a workload that keeps an AWS client alive past the TTL.
3. After ~1h, the long-lived client fails with `ExpiredTokenException` while the dbt run is still in progress.

### Relevant log output

```shell
botocore.exceptions.ClientError: An error occurred (ExpiredTokenException) when calling the GetQueryExecution operation: The security token included in the request is expired
```

### Environment

```markdown
OS: macOS 26.4
Python: 3.12.8
dbt-adapters: 1.22.10
dbt-athena: 1.11.0b1 (current `main`; behavior introduced in #1657)
```

### Additional Context

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.