Apps
AWS CLI Cache
Under ~/.aws/cli/cache, the AWS CLI stores JSON cache files for temporary STS credentials and cached role-assumption results so repeated commands do not have to request fresh tokens every time. Those files are created when profiles use AssumeRole, SSO-backed sessions, or other temporary credential flows, and they can become stale, corrupted, or simply accumulate over time. Kudu removes these cached credential and API response JSON files without touching your configured profiles, account settings, access keys, or any AWS resources.
Why clean AWS CLI Cache?
- Expired STS session files in the cache can make commands fail with ExpiredToken or InvalidClientTokenId until the CLI fetches fresh credentials
- Corrupted JSON cache entries under ~/.aws/cli/cache can trigger credential resolution errors, showing up as sudden auth failures even though the profile configuration is still correct
- Stale AssumeRole cache data after permission or trust-policy changes can cause AccessDenied responses until the old cached session is discarded
- Switching between accounts, roles, or SSO sessions can leave behind many cached credential files, making the cache directory grow unexpectedly and clutter disk usage
- Cached temporary credentials tied to an old MFA or SSO login state can cause repeated prompts or confusing login failures until the session cache is rebuilt
- After clock skew corrections or local time changes, previously cached temporary credentials may appear invalid, and users often notice commands that worked earlier now fail immediately
- Old cache files can make troubleshooting harder because the CLI keeps reusing a bad session; clearing them forces a clean credential refresh without changing profiles or saved settings
What gets cleaned
Cache paths Kudu targets
Windows
~/.aws/cli/cache |
macOS
~/.aws/cli/cache |
Linux
~/.aws/cli/cache |
Frequently asked
Common questions about AWS CLI Cache
Related cleaners
Free & open source
Download Kudu and reclaim your disk space.
Available on Windows, macOS, and Linux. No account required, no feature gates, no telemetry without consent. All cleaning targets are open source and community-auditable.