AWS S3: An error occurred (ExpiredToken)… The provided token has expired

The problem:

You’re trying to access AWS S3 using the CLI utility, via (say) aws s3 ls. You’re supplying credentials via AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. You get an error:

An error occurred (ExpiredToken) when calling the ListBuckets operation:
The provided token has expired.

The solution:

You need to set AWS_SESSION_TOKEN to an empty string. Otherwise the AWS CLI grabs a session token from who knows where and tries to use that.

This problem also seems to affect s3cmd, presumably because it uses Amazon’s AWS libraries.