fix(toolkit-lib): throw AuthenticationError instead of ExpiredToken (#736)

kaizencc · web-flow · commit 9f8d2ec3e7cf · 2025-07-30T15:49:26.000Z
We own the `AuthenticationError` while `ExpiredToken` comes directly
from the SDKs.

---
By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache-2.0 license
diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/aws-auth/sdk-provider.ts b/packages/@aws-cdk/toolkit-lib/lib/api/aws-auth/sdk-provider.ts
@@ -182,7 +182,7 @@ export class SdkProvider {
       return { sdk, didAssumeRole: true };
     } catch (err: any) {
       if (err.name === 'ExpiredToken') {
-        throw err;
+        throw AuthenticationError.withCause('Assuming role failed: ExpiredToken', err);
       }
 
       // AssumeRole failed. Proceed and warn *if and only if* the baseCredentials were already for the right account

Original file line number	Diff line number	Diff line change
`@@ -182,7 +182,7 @@ export class SdkProvider {`
`182`	`182`	`return { sdk, didAssumeRole: true };`
`183`	`183`	`} catch (err: any) {`
`184`	`184`	`if (err.name === 'ExpiredToken') {`
`185`		`- throw err;`
	`185`	`+ throw AuthenticationError.withCause('Assuming role failed: ExpiredToken', err);`
`186`	`186`	`}`
`187`	`187`
`188`	`188`	`// AssumeRole failed. Proceed and warn if and only if the baseCredentials were already for the right account`