Why Does AWS CLI Return Access Denied After SSO Configuration?

Why the Answer Is Correct

IAM Identity Center (AWS SSO) issues federated role credentials that are temporary by design, with a configurable session duration. When those credentials expire, the AWS CLI and SDKs can no longer authenticate API calls, and the service returns Access Denied. Because the developer has not changed configuration files, scripts, or permission sets, the sudden onset of errors strongly suggests that the cached SSO credentials have simply exceeded their lifetime. Comment [1] with 4 likes reinforces that SSO credentials are temporary and typically come with an expiration time. This makes C the most logical and direct answer.

Why the Other Options Are Wrong

A is unlikely because changes to the CLI binary file permissions would cause a different error, such as "permission denied" when executing the binary, not an Access Denied response from AWS services. B suggests the permission set is missing required actions, but the question states everything was working before and no configuration has changed; permission sets do not spontaneously lose permissions without an administrative change. D (wrong account) could produce an error, but the same credentials and CLI configuration that previously worked would not suddenly point to a different account without a config change. Therefore, C is the only option that aligns with the scenario's unchanged environment and the known behavior of SSO temporary credentials.

Community Comment Notes

The community overwhelmingly voted for C with 100% of votes. Comment [1] (likes=4) highlights that AWS SSO credentials are temporary and expire. Comment [2] (likes=3) points to the official AWS Identity documentation, which explains the nature of temporary security credentials. Comment [3] (likes=1) simply affirms C. The consensus is clear: when a previously working setup begins returning Access Denied without any configuration changes, credential expiration is the first thing to investigate.