dbt-labs / dbt-labs/dbt-adapters
[Bug] dbt-athena: AssumeRole credentials expire mid-run for long-lived AWS clients
- Dominant language
- Python
- Stars
- 233
- Forks
- 362
- Avg merge
- 3d 22h
- Merged PRs (30d)
- 9
Description
### Is this a new bug?
- [x] I believe this is a new bug
- [x] I have searched the existing issues, and I could not find an existing issue for this bug
### Which packages are affected?
- [ ] dbt-adapters
- [ ] dbt-tests-adapter
- [x] dbt-athena
- [ ] dbt-athena-community
- [ ] dbt-bigquery
- [ ] dbt-postgres
- [ ] dbt-redshift
- [ ] dbt-snowflake
- [ ] dbt-spark
### Current Behavior
`_get_assume_role_session` (introduced in #1657) builds a `boto3.Session` from **static** key/secret/token values returned by `sts:AssumeRole`, and rotates the cached session via an `lru_cache` TTL bucket.
Rotating the session reference does not help clients that already hold one: a client built from a previously-cached session keeps the stale static credentials, and boto3 has no hook to refresh them. After the AssumeRole TTL elapses, any long-lived AWS client surfaces `ExpiredTokenException` mid-run.
### Expected Behavior
Credentials should refresh transparently for the life of the session, so clients derived from it keep working without the caller juggling TTLs. `botocore.credentials.RefreshableCredentials` provides exactly this via a `refresh_using` callable that re-invokes `sts:AssumeRole` in place.
### Steps To Reproduce
1. Configure a dbt-athena profile with `assume_role_arn` set and default `assume_role_duration_seconds` (3600).
2. Run a workload that keeps an AWS client alive past the TTL.
3. After ~1h, the long-lived client fails with `ExpiredTokenException` while the dbt run is still in progress.
### Relevant log output
```shell
botocore.exceptions.ClientError: An error occurred (ExpiredTokenException) when calling the GetQueryExecution operation: The security token included in the request is expired
```
### Environment
```markdown
OS: macOS 26.4
Python: 3.12.8
dbt-adapters: 1.22.10
dbt-athena: 1.11.0b1 (current `main`; behavior introduced in #1657)
```
### Additional Context
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.