fix(cli): CLI hangs for 10 minutes on expired credentials

packages/aws-cdk/lib/api/aws-auth/awscli-compatible.ts

@@ -344,5 +344,4 @@ async function tokenCodeFn(serialArn: string, cb: (err?: Error, token?: string)
     debug('Failed to get MFA token', err);
     cb(err);
   }
-}
-
+}

packages/aws-cdk/lib/api/aws-auth/sdk-provider.ts

@@ -194,6 +194,10 @@ export class SdkProvider {
       await sdk.forceCredentialRetrieval();
       return { sdk, didAssumeRole: true };
     } catch (e) {
+      if (isUnrecoverableAwsError(e)) {
+        throw e;
+      }
+
       // AssumeRole failed. Proceed and warn *if and only if* the baseCredentials were already for the right account
       // or returned from a plugin. This is to cover some current setups for people using plugins or preferring to
       // feed the CLI credentials which are sufficient by themselves. Prefer to assume the correct role if we can,
@@ -270,6 +274,10 @@ export class SdkProvider {
 
         return await new SDK(creds, this.defaultRegion, this.sdkOptions).currentAccount();
       } catch (e) {
+        if (isUnrecoverableAwsError(e)) {
+          throw e;
+        }
+
         debug('Unable to determine the default AWS account:', e);
         return undefined;
       }
@@ -541,3 +549,10 @@ function fmtObtainedCredentials(
       return msg.join('');
   }
 }
+
+/**
+ * Return whether an error should not be recovered from
+ */
+export function isUnrecoverableAwsError(e: Error) {
+  return (e as any).code === 'ExpiredToken';
+}

packages/aws-cdk/lib/api/aws-auth/sdk.ts

@@ -3,7 +3,7 @@ import type { ConfigurationOptions } from 'aws-sdk/lib/config-base';
 import { debug, trace } from './_env';
 import { AccountAccessKeyCache } from './account-cache';
 import { cached } from './cached';
-import { Account } from './sdk-provider';
+import { Account, isUnrecoverableAwsError } from './sdk-provider';
 
 // We need to map regions to domain suffixes, and the SDK already has a function to do this.
 // It's not part of the public API, but it's also unlikely to go away.
@@ -234,6 +234,9 @@ export class SDK implements ISDK {
     try {
       await this._credentials.getPromise();
     } catch (e) {
+      if (isUnrecoverableAwsError(e)) {
+        throw e;
+      }
       debug(`Assuming role failed: ${e.message}`);
       throw new Error([
         'Could not assume role in target account',

packages/aws-cdk/test/api/fake-sts.ts

@@ -69,7 +69,7 @@ export class FakeSts {
             _attributes: { xmlns: 'https://sts.amazonaws.com/doc/2011-06-15/' },
             Error: {
               Type: 'Sender',
-              Code: 'Error',
+              Code: e.code ?? 'Error',
               Message: e.message,
             },
             RequestId: '1',
@@ -159,6 +159,13 @@ export class FakeSts {
   private handleAssumeRole(mockRequest: MockRequest): Record<string, any> {
     const identity = this.identity(mockRequest);
 
+    const failureRequested = mockRequest.parsedBody.RoleArn.match(/<FAIL:([^>]+)>/);
+    if (failureRequested) {
+      const err = new Error(`STS failing by user request: ${failureRequested[1]}`);
+      (err as any).code = failureRequested[1];
+      throw err;
+    }
+
     this.assumedRoles.push({
       roleArn: mockRequest.parsedBody.RoleArn,
       roleSessionName: mockRequest.parsedBody.RoleSessionName,

packages/aws-cdk/test/api/sdk-provider.test.ts

@@ -402,6 +402,22 @@ describe('with intercepted network calls', () => {
       // THEN
       expect((await sdk.currentAccount()).accountId).toEqual(uniq('88888'));
     });
+
+    test('if AssumeRole fails because of ExpiredToken, then fail completely', async () => {
+      // GIVEN
+      prepareCreds({
+        fakeSts,
+        config: {
+          default: { aws_access_key_id: 'foo', $account: '88888' },
+        },
+      });
+      const provider = await providerFromProfile(undefined);
+
+      // WHEN - assumeRole fails with a specific error
+      await expect(async () => {
+        await provider.forEnvironment(env(uniq('88888')), Mode.ForReading, { assumeRoleArn: '<FAIL:ExpiredToken>' });
+      }).rejects.toThrow(/ExpiredToken/);
+    });
   });
 
   describe('Plugins', () => {