Requirement Summary:

Developer usesAWS IAM Identity Center (SSO)withAWS CLI / SDKs

Initially working fine

Now receiving AccessDenied errors

No changes to config or scripts

Key Understanding:

IAM Identity Center credentials aretemporary and time-limited. When you use SSO-based access via the AWS CLI (aws sso login), it obtainstemporary credentialsstored in the local cache.

By default,these expire in 1 hour(can be extended).

Evaluate Options:

A. Permissions to CLI binary changed

❌Unlikely – this would produce execution errors, not AccessDenied from AWS API

B. Permission set lacks required permissions

❌Then the error would have occurred from the beginning, not after time

✅C. IAM Identity Center credentials expired

✅Most likely– user hasn't refreshed credentials using aws sso login again

After expiration, API calls fail with AccessDenied

D. Developer is calling the wrong AWS account

❌Would likely show different types of errors (AccountNotFound, etc.)

SSO and AWS CLI:https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html

Troubleshooting SSO CLI:https://docs.aws.amazon.com/cli/latest/userguide/sso-configure-profile-token.html