aws login refresh fails after ~10 minutes with CreateOAuth2Token INVALID_REQUEST

[gmcnickle]

Describe the bug

When performing long-running AWS CLI operations using aws login, authentication begins failing after approximately 10–11 minutes.

The initial login succeeds and AWS CLI operations work normally until the cached login credential requires refresh. At that point, subsequent commands fail during CreateOAuth2Token with:

An error occurred (ValidationException) when calling the CreateOAuth2Token operation:
The provided authorization grant is invalid, expired, revoked, or malformed

error: INVALID_REQUEST

This appears very similar to the previously reported and now-closed issue #10267:
#10267

However, I have reproduced the behavior using multiple AWS login regions, so the current issue does not appear to be region-specific.

The problem is reproducible independently of any application or deployment script by repeatedly invoking aws sts get-caller-identity after a successful aws login. The failure consistently occurs approximately 10–11 minutes after login.

NOTE: The issue is currently reproducible on aws-cli/2.36.36 Python/3.14.6 Windows/10 script-exe/AMD64. It was originally detected on aws-cli/2.36.27 Python/3.14.6 Windows/10 script-exe/AMD64.

Regression Issue

• Select this option if this issue appears to be a regression.

Expected Behavior

After a successful aws login, AWS CLI commands should continue to authenticate successfully for the duration of the login session.

When the short-lived login credentials expire, the AWS CLI should automatically refresh them using the cached login session without requiring the user to run aws login again or interrupting long-running CLI operations.

Current Behavior

After approximately 10–11 minutes following a successful aws login, AWS CLI commands begin failing when the CLI attempts to refresh the login credentials.

The refresh attempt fails with:

An error occurred (ValidationException) when calling the CreateOAuth2Token operation:
The provided authorization grant is invalid, expired, revoked, or malformed

Additional error details:
error: INVALID_REQUEST

Running aws login again restores access temporarily, but the same failure recurs approximately 10–11 minutes later.

Reproduction Steps

1. Log in using an AWS CLI login profile:

aws login --profile example-profile --region us-east-2

2. Complete the browser-based login.

3. Run the following PowerShell script. It invokes sts get-caller-identity every 30 seconds until the AWS CLI returns a failure, then reports the elapsed time:

$start = Get-Date

while ($true) {
    Get-Date

    aws sts get-caller-identity --profile example-profile --no-cli-pager

    if ($LASTEXITCODE -ne 0) {
        break
    }

    Start-Sleep -Seconds 30
}

$elapsed = (Get-Date) - $start
Write-Host "Failure after $($elapsed.TotalMinutes) minutes."

4. Observe that get-caller-identity initially succeeds on each invocation.

5. After approximately 10–11 minutes, observe that the command fails when AWS CLI attempts to refresh the login credentials:

aws: [ERROR]: An error occurred (ValidationException) when calling the CreateOAuth2Token operation: The provided authorization grant is invalid, expired, revoked, or malformed

Additional error details:
error: INVALID_REQUEST

The issue has been reproduced using multiple AWS login regions.

Possible Solution

No response

Additional Information/Context

No response

CLI version used

aws-cli/2.36.36 Python/3.14.6 Windows/10 script-exe/AMD64

Environment details (OS name and version, etc.)

Microsoft Windows 10.0.19045, Powershell 7.6.5