Terraform: AWS SSO credentials issue

2023-06-27

Today, while working on a client's Infrastructure-as-Code definitions, I encountered an interesting issue.

Trying to import resources, I ended up with access token expired error even though I’ve logged in with aws sso command just seconds ago.

AWS_PROFILE=client TF_WORKSPACE=staging terraform -chdir=infrastructure import "aws_ecs_task_definition.api" "arn:aws:ecs:us-west-2:1234567890:task-definition/api:1"
╷
│ Error: error configuring Terraform AWS Provider: no valid credential sources for Terraform AWS Provider found.
│
│ Please see https://registry.terraform.io/providers/hashicorp/aws
│ for more information about providing credentials.
│
│ Error: failed to refresh cached credentials, the SSO session has expired or is invalid: access token is expired
│
│
│   with provider["registry.terraform.io/hashicorp/aws"],
│   on /Users/semyon/consulting/client/api/infrastructure/main.tf line 20, in provider "aws":
│   20: provider "aws" {
│
╵

I have tried to log in multiple times with no success. While searching online, I found a couple of possible solutions, but only one of them worked. Here it is, and I hope it helps someone.

  1. Open your AWS config file ~/.aws/config and remove everything related to the SSO session

    [profile client]
sso_start_url = https://client.awsapps.com/start
sso_region = us-west-2
sso_account_id = 1234567890
sso_role_name = AdministratorAccess
region = us-west-2
output = json
sso_session = client
[sso-session client]
sso_start_url = https://client.awsapps.com/start
sso_region = us-west-2
sso_registration_scopes = sso:account:access

  2. Log out of AWS SSO and then login back. The logout is important here

    aws sso logout --profile client
aws sso login --profile client

  3. Run your Terraform commands and enjoy

    AWS_PROFILE=client TF_WORKSPACE=staging terraform -chdir=infrastructure import "aws_ecs_task_definition.api" "arn:aws:ecs:us-west-2:1234567890:task-definition/api:1"
 
Import successful!
The resources that were imported are shown above. These resources are now inyour Terraform state and will henceforth be managed by Terraform.