UnrecognizedClientException: The security token included in the request is invalid

[altonotch]

I've configured logs forwarding to CloudWatch via fluent-bit. It worked for about a month and then stopped forwarding the logs due to this error.

I have an SSM agent on the server. It refreshes the credentials every half an hour.
While the plugin fails due to invalid credentials, I can perform calls via aws cli and it works.
The creds are shared via the credentials file. Restarting the process makes things work for a while again.

What might be causing this?