AWS SSO CLI Auth Config SSOProviderInvalidToken Error

[ryehowell]

Describe the bug
Some users are reporting an issue when using AWS SSO auth with the CLI. When using SSO, there have been reported errors of the following:

kubergrunt eks verify --eks-cluster-arn arn:aws:eks:us-east-1:[redacted]:cluster/dev-comm
[] INFO[2025-04-18T14:46:23-04:00] Checking if EKS cluster arn:aws:eks:us-east-1:[redacted]::cluster/dev-comm exists  name=kubergrunt
[] INFO[2025-04-18T14:46:23-04:00] Retrieving details for EKS cluster arn:aws:eks:us-east-1:[redacted]::cluster/dev-comm  name=kubergrunt
[] INFO[2025-04-18T14:46:23-04:00] Detected cluster deployed in region us-east-1  name=kubergrunt
[] ERRO[2025-04-18T14:46:23-04:00] EKS cluster arn:aws:eks:us-east-1:[redacted]::cluster/dev-comm is not active yet  name=kubergrunt
[] ERRO[2025-04-18T14:46:23-04:00] Did not specify wait. Aborting...             name=kubergrunt
ERROR: Error finding AWS credentials. Did you set the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables or configure an AWS profile? Underlying error: SSOProviderInvalidToken: the SSO session has expired or is invalid

To Reproduce
Steps to reproduce the behavior including the relevant Terraform/Terragrunt/Packer version number and any code snippets and module inputs you used.

kubergrunt eks verify --eks-cluster-arn <cluster-arn>

Expected behavior
Authentication should happen without error

Nice to have

• Terminal output
• Screenshots

Additional context
Add any other context about the problem here.

[nathanielnderson]

This might also tie in to an issue that I'm having with kubergrunt in the gitlab pipeline. I posted in community about this but I'm, seeing this:

It would appear that even though I've got my karpenter and my alb-ingress modules that need it in my pipeline but the pipeline can't find the executable for some reason.

  │ Error: Kubernetes cluster unreachable: Get "https://<redacted>.eks.amazonaws.com/version": getting credentials: exec: executable kubergrunt not found
  │ 
  │ It looks like you are trying to use a client-go credential plugin that is not installed.
  │ 
  │ To learn more about this feature, consult the documentation available at:
  │       https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins
  │ 
  │   with module.karpenter.helm_release.karpenter_crd[0],
  │   on .terraform/modules/karpenter/modules/eks-k8s-karpenter/main.tf line 676, in resource "helm_release" "karpenter_crd":
  │  676: resource "helm_release" "karpenter_crd" {
  │ 
  ╵

I know that my eks-cluster-control-plane is supposed to snag it as I've got it setup to do so:

  # Description: When set to true, this will enable kubergrunt verification to wait for the Kubernetes API server to come up before completing. If false, reverts to a 30 second timed wait instead.

  # Type: bool
  use_kubergrunt_verification = true


  # Description: Automatically download and install Kubergrunt if it isn't already installed on this OS. Only used if var.use_kubergrunt_verification is true.
  # Type: bool
  auto_install_kubergrunt = true


  # Description: The URL from which to download Kubergrunt if it's not installed already. Only used if var.use_kubergrunt_verification and var.auto_install_kubergrunt are true.
  # Type: string
  kubergrunt_download_url = "https://github.com/gruntwork-io/kubergrunt/releases/download/v0.17.2/kubergrunt"

During pipeline execution I do see that it attempts to snag it, I don't see any failure either:

/services/eks-cluster-control-plane|Downloading git::https://github.com/gruntwork-io/terraform-aws-utilities.git?ref=v0.10.5 for install_kubergrunt...
/services/eks-cluster-control-plane|- install_kubergrunt in .terraform/modules/install_kubergrunt/modules/executable-dependency
/services/eks-cluster-control-plane|Downloading git::https://github.com/gruntwork-io/terraform-aws-utilities.git?ref=v0.10.5 for require_kubergrunt...
/eks-cluster-control-plane|- require_kubergrunt in .terraform/modules/require_kubergrunt/modules/require-executable
...
...
/services/eks-cluster-control-plane|  ~ kubergrunt_path                                           = "/usr/local/bin/kubergrunt" -> "./kubergrunt-installation/

However sure enough when the karpenter and alb-ingress modules run they fail due to not being able to find it.
Just for reference I'm using the same provider configuration inside the prod example suite so I've got the provider_k8s_helm_for_eks.hcl out there along with the helm provider generation block in both of those modules.
Any assistance on this would be appreciated cause it's putting a kink in the pipeline workflow.

Those modules also have a depends call on the eks-cluster-control-plane module by the way.