"SSO session associated with this profile is invalid" when querying Dynamo -- but using AWS_SESSION_TOKEN etc for credentials

[jcollum-nutrien]

When I try to get an item from Dynamo I get an error: CredentialsProviderError: The SSO session associated with this profile is invalid. To refresh this SSO session run aws sso login with the corresponding profile.

The issue is that we aren't using aws cli to log in, we are using env vars that we grab from our SSO portal https://d-blah.awsapps.com/start#/ which gives AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN that are good for 4 hours. I have DEFINITELY pasted new values before attempting this. The database is definitely in us-east-2

env vars:

✗ env | grep AWS
AWS_PROFILE=default
AWS_REGION=us-east-2
AWS_DEFAULT_REGION=us-east-2
AWS_ACCESS_KEY_ID=ASIA6MRDredacted
AWS_SECRET_ACCESS_KEY=JZ+2zt1nwdmredacted
AWS_SESSION_TOKEN=IQoJb3JpZ2luX2VjEBredacted=

redacted = pulled that portion out on purpose

To verify that the env vars work I ran aws dynamodb describe-table --table-name=foo and got results back.

My credentials file doesn't exist (this is expected):

✗ ls ~/.aws/credentials
ls: /Users/justin.collum/.aws/credentials: No such file or directory

Code that isn't accessing dynamo has been running fine.

Code:

public async getItem(params: GetItemCommandInput) {
    try {
      return await this.client?.send(new GetItemCommand(params)); // <---- failing here 
    } catch (err) {
      logger.error(`Trying to get item from dynamodb return: ${err}`);
      throw err;
    }
  }

Stack trace:

"stackTrace": [
		"resolveSSOCredentials (/Users/justin.collum/Documents/work/fields-dp/node_modules/@aws-sdk/credential-provider-node/node_modules/@aws-sdk/credential-provider-sso/dist-cjs/resolveSSOCredentials.js:30:19)",
		"async coalesceProvider (/Users/justin.collum/Documents/work/fields-dp/node_modules/@aws-sdk/credential-provider-node/node_modules/@aws-sdk/property-provider/dist-cjs/memoize.js:14:24)",
		"async Va.credentialProvider (/Users/justin.collum/Documents/work/fields-dp/node_modules/@aws-sdk/credential-provider-node/node_modules/@aws-sdk/property-provider/dist-cjs/memoize.js:33:24)",
		"async Va.signRequest (/Users/justin.collum/Documents/work/fields-dp/lambdas/dosEventSubscriber/dist/index.js:84:514)",
		"async /Users/justin.collum/Documents/work/fields-dp/lambdas/dosEventSubscriber/dist/index.js:94:2602",
		"async /Users/justin.collum/Documents/work/fields-dp/lambdas/dosEventSubscriber/dist/index.js:83:38298",
		"async /Users/justin.collum/Documents/work/fields-dp/lambdas/dosEventSubscriber/dist/index.js:83:29800",
		"async Un.insertItem (/Users/justin.collum/Documents/work/fields-dp/lambdas/dosEventSubscriber/dist/index.js:96:41643)",
		"async Un.insertApiToken (/Users/justin.collum/Documents/work/fields-dp/lambdas/dosEventSubscriber/dist/index.js:96:41942)",
		"async $n.getCurrentToken (/Users/justin.collum/Documents/work/fields-dp/lambdas/dosEventSubscriber/dist/index.js:96:43174)"
	]

So why would a Dynamo command require (and fail) resolveSSOCredentials when I have env vars that give me access?