[BUG] CC not taking the updated credentials with awsAuthRefresh

Hi team, I have the same issue and this is the details.

I setup awsAuthRefresh to ./claude/settings.local.json like the below.
I added the command(aws-azure-login --no-prompt) which refreshes and creates a new aws_access_key_id, aws_secret_access_key and aws_session_token with 1 hour expiration.

{
  "awsAuthRefresh": "aws-azure-login --no-prompt",
  "env": {
    "CLAUDE_CODE_USE_BEDROCK": "1",
    "AWS_PROFILE": "default",
    "AWS_REGION": "us-east-1",
    "ANTHROPIC_MODEL": "arn:aws:bedrock:us-east-1:670*********:application-inference-profile/lf1*******",
    "ANTHROPIC_SMALL_FAST_MODEL": "arn:aws:bedrock:us-east-1:670*********:application-inference-profile/lf1*******"
  }
}

In claude code, when the session expire, it runs the command (aws-azure-login --no-prompt).
I checked ~/.aws/credentials and can see the new aws_access_key_id, aws_secret_access_key and aws_session_token are created.
But the claude code does not use the new created aws_access_key_id, aws_secret_access_key and aws_session_token and shows the error like this.

> hi
(node:36932) NOTE: We are formalizing our plans to enter AWS SDK for JavaScript (v2) into maintenance mode in 2023.

Please migrate your code to use AWS SDK for JavaScript (v3).
For more information, check the migration guide at https://a.co/7PzMCcy
(Use `node --trace-warnings ...` to show where the warning was created)

Logging in with profile 'default'...

Using AWS SAML endpoint https://signin.aws.amazon.com/saml

Assuming role arn:aws:iam::670*********:role/aws-************-****-admin

  ⎿  API Error (403 The security token included in the request is expired) · Retrying in 1 seconds… (attempt 1/10)
  ⎿  API Error (403 The security token included in the request is expired) · Retrying in 1 seconds… (attempt 2/10)
  ⎿  API Error (403 The security token included in the request is expired) · Retrying in 2 seconds… (attempt 3/10)
  ⎿  API Error (403 The security token included in the request is expired) · Retrying in 4 seconds… (attempt 4/10)
  ⎿  API Error (403 The security token included in the request is expired) · Retrying in 10 seconds… (attempt 5/10)
  ⎿  API Error (403 The security token included in the request is expired) · Retrying in 18 seconds… (attempt 6/10)
  ⎿  API Error (403 The security token included in the request is expired) · Retrying in 34 seconds… (attempt 7/10)
  ⎿  API Error (403 The security token included in the request is expired) · Retrying in 38 seconds… (attempt 8/10)
  ⎿  API Error (403 The security token included in the request is expired) · Retrying in 37 seconds… (attempt 9/10)

This is also not working for me either. I have configured both awsAuthRefresh and awsCredentialExport. Note, I found that the suggested command for awsCredentialExport:

aws sts get-session-token --profile dev-user --output json

does not work for me. I get this error:

An error occurred (AccessDenied) when calling the GetSessionToken operation: Cannot call GetSessionToken with session credentials

To mitigate this, I created a script to use aws configure export-credentials --profile "${PROFILE}" --format process and jq to format the output into the JSON format specified for advanced credential configuration. When I run my script, I can verify it gives the proper output:

> ~/.claude/aws-export-credentials-json.sh dev-user
{
  "Credentials": {
    "AccessKeyId": "***",
    "SecretAccessKey": "***",
    "SessionToken": "***",
    "Expiration": "2025-07-18T02:38:43+00:00"
  }
}

With this working, I have configured my claude settings as follows:

{
  "awsAuthRefresh": "aws sso login --profile dev-user,
  "awsCredentialExport": "~/.claude/aws-export-credentials-json.sh dev-user",
  "env": {
    "CLAUDE_CODE_USE_BEDROCK": 1,
    "AWS_REGION": "us-west-2",
    "ANTHROPIC_MODEL": "arn:aws:bedrock:us-west-2:***:application-inference-profile/***",
    "CLAUDE_CODE_MAX_OUTPUT_TOKENS": "4096",
    "MAX_THINKING_TOKENS": "1024",
    "ANTHROPIC_SMALL_FAST_MODEL": "arn:aws:bedrock:us-west-2:***:application-inference-profile/***"
  }
}

If I launch claude code without any credentials, it successfully logs me in:

<img width="1912" height="442" alt="Image" src="https://github.com/user-attachments/assets/4a552695-6e81-40f3-81ab-5430f368da84" />

However, performing any tasks continue to fail with the same 403 The security token included in the request is invalid error. Since login was successful, it appears that the credentials are not being exported properly.

In the meantime, I am using this bash function in my ~/.zprofile to ensure I'm logged in when I launch claude:

claude-sso() {
  local PROFILE_NAME="dev-user" # Define your profile name here

  # Clear any potentially stale AWS_ACCESS_KEY_ID, etc. from previous exports
  unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN AWS_SESSION_EXPIRATION AWS_PROFILE

  # Attempt to get caller identity. We capture stdout and stderr.
  # If this command does NOT succeed (returns non-zero exit code), then we assume login is needed.
  if ! aws sts get-caller-identity > /dev/null 2>&1; then
    echo "AWS credentials are not valid or require refresh. Initiating full AWS SSO login..."
    # Perform the SSO login. This will open a browser if needed.
    aws sso login --profile "${PROFILE_NAME}" || { echo "AWS SSO login failed. Aborting."; return 1; }
    echo "AWS SSO login successful."

    # After a fresh login, verify again. If this fails, something is fundamentally wrong.
  else
    echo "AWS credentials for profile '${PROFILE_NAME}' are active."
  fi

  # Set credential environment variables before launching claude
  eval "$(aws configure export-credentials --profile "${PROFILE_NAME}" --format env)" || { echo "Failed to export credentials. Aborting."; return 1; }

  claude "$@" # Pass any arguments to claude (e.g., --continue)
}

I hope this helps.

@leotac and @Yukitada-Ri - we've isolated the issue to an issue preventing ~/.aws/credentials from being reread after update. Thank you both for the detailed posts about your configurations, this was very helpful (turns out aws sso based flows don't have this same issue). We're working on a patch.

@mattscully - thanks as well for posting your configuration. If you're using a predefined (static) profile and aws sso login, may I suggest this configuration:

settings.json

{
  "awsAuthRefresh": "aws sso login --profile dev-user",
  "env": {
    "AWS_PROFILE": "dev-user"
  }
}

Because you're using an aws sso configuration, you shouldn't need to explicitly export the credentials via awsCredentialExport (it's primarily meant for people who have scripts that can't modify .aws/credentials).

We've issued a patch for this, which will go out in v1.0.56 or v1.0.57 - I will post here when that's complete.

Released in v1.0.56 today - though it's not tagged as latest yet.

This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.