A developer uses AWS IAM Identity Center (AWS SSO) to access AWS via the CLI and SDKs from a local workstation. API calls worked initially but are now returning Access Denied, and no local configuration or scripts were changed. What is the most likely cause of the access failures?

When using AWS IAM Identity Center (formerly AWS SSO) for CLI and SDK access, developers obtain temporary, short-lived credentials. These credentials have an expiration time, typically an hour or less, after which they become invalid. If API calls start failing with "Access Denied" without any changes to local configurations or scripts, the most likely cause is that these temporary credentials have expired. The developer needs to re-authenticate through IAM Identity Center to refresh their credentials. Incorrect options: File permissions on the AWS CLI executable changing would likely prevent the CLI from running at all, not just result in "Access Denied" errors for API calls. While a permission set change could cause "Access Denied," the prompt states no local configuration or scripts were changed, implying the permission set itself wasn't modified by the developer. This is less likely than credential expiration, which is a routine occurrence. Targeting the wrong AWS account would typically result in "Access Denied" if the federated role doesn't exist or isn't authorized in that account, but the prompt implies initial success, making an accidental account change less probable than credential expiration.