Why Does AWS CLI Return Access Denied After SSO Configuration?
A developer uses AWS IAM Identity Center (AWS Single Sign-On) to interact with the AWS CLI and AWS SDKs on a local workstation. API calls to AWS services were working when the SSO access was first configured. However, the developer is now receiving Access Denied errors. The developer has not changed any configuration files or scripts that were previously working on the workstation. What is the MOST likely cause of the developer's access issue?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests your understanding that IAM Identity Center issues temporary credentials that expire, and expiration can manifest as Access Denied even when the underlying permission set is correct and unchanged.
When AWS Single Sign-On (IAM Identity Center) credentials expire, AWS CLI and SDK API calls fail with Access Denied errors. Community consensus identifies temporary credential expiration as the most likely cause when configuration files remain unchanged.
Choosing B (permission set lacks permissions) is common because Access Denied usually suggests an IAM permissions problem, but the question explicitly states that configuration hasn't changed and the calls were previously working, making credential expiration a more likely explanation.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
IAM Identity Center (AWS SSO) issues federated role credentials that are temporary by design, with a configurable session duration. When those credentials expire, the AWS CLI and SDKs can no longer authenticate API calls, and the service returns Access Denied. Because the developer has not changed configuration files, scripts, or permission sets, the sudden onset of errors strongly suggests that the cached SSO credentials have simply exceeded their lifetime. Comment [1] with 4 likes reinforces that SSO credentials are temporary and typically come with an expiration time. This makes C the most logical and direct answer.
Why the Other Options Are Wrong
A is unlikely because changes to the CLI binary file permissions would cause a different error, such as "permission denied" when executing the binary, not an Access Denied response from AWS services. B suggests the permission set is missing required actions, but the question states everything was working before and no configuration has changed; permission sets do not spontaneously lose permissions without an administrative change. D (wrong account) could produce an error, but the same credentials and CLI configuration that previously worked would not suddenly point to a different account without a config change. Therefore, C is the only option that aligns with the scenario's unchanged environment and the known behavior of SSO temporary credentials.
Community Comment Notes
The community overwhelmingly voted for C with 100% of votes. Comment [1] (likes=4) highlights that AWS SSO credentials are temporary and expire. Comment [2] (likes=3) points to the official AWS Identity documentation, which explains the nature of temporary security credentials. Comment [3] (likes=1) simply affirms C. The consensus is clear: when a previously working setup begins returning Access Denied without any configuration changes, credential expiration is the first thing to investigate.
Official Reference
Exam Strategy
For AWS CLI/SDK access issues in exam questions, look for clues like 'previously working' and 'no changes made.' If an answer mentions credential expiration, that is often the correct choice because IAM Identity Center issues temporary credentials with a finite lifetime. Always associate SSO with temporary, expiring credentials rather than permanent IAM users.
Related Analysis
Practice All DVA-C02 Questions
Access 100 questions with complete answers and detailed explanations.
View Full DVA-C02 Practice Test →