diff --git a/src/aws/flb_aws_util.c b/src/aws/flb_aws_util.c
index dead873e39b..c53a151f910 100644
--- a/src/aws/flb_aws_util.c
+++ b/src/aws/flb_aws_util.c
@@ -346,16 +346,16 @@ int flb_aws_is_auth_error(char *payload, size_t payload_size)
         return FLB_FALSE;
     }
 
-    /* Fluent Bit calls the STS API which returns XML */
-    if (strcasestr(payload, "InvalidClientTokenId") != NULL) {
-        return FLB_TRUE;
-    }
-
-    if (strcasestr(payload, "AccessDenied") != NULL) {
-        return FLB_TRUE;
-    }
-
-    if (strcasestr(payload, "Expired") != NULL) {
+    /* STS, S3, and other AWS APIs return XML error responses */
+    if (strcasestr(payload, "InvalidClientTokenId") != NULL ||
+        strcasestr(payload, "AccessDenied") != NULL ||
+        strcasestr(payload, "Expired") != NULL ||
+        strcasestr(payload, "InvalidAccessKeyId") != NULL ||
+        strcasestr(payload, "SignatureDoesNotMatch") != NULL ||
+        strcasestr(payload, "InvalidToken") != NULL ||
+        strcasestr(payload, "InvalidSecurity") != NULL ||
+        strcasestr(payload, "TokenRefreshRequired") != NULL ||
+        strcasestr(payload, "InvalidSignature") != NULL) {
         return FLB_TRUE;
     }
 
@@ -372,6 +372,9 @@ int flb_aws_is_auth_error(char *payload, size_t payload_size)
             strcmp(error, "InvalidClientTokenId") == 0 ||
             strcmp(error, "InvalidToken") == 0 ||
             strcmp(error, "InvalidAccessKeyId") == 0 ||
+            strcmp(error, "InvalidSecurity") == 0 ||
+            strcmp(error, "TokenRefreshRequired") == 0 ||
+            strcmp(error, "InvalidSignature") == 0 ||
             strcmp(error, "UnrecognizedClientException") == 0) {
                 flb_sds_destroy(error);
             return FLB_TRUE;
diff --git a/tests/internal/aws_util.c b/tests/internal/aws_util.c
index b59264cd114..dae4f298401 100644
--- a/tests/internal/aws_util.c
+++ b/tests/internal/aws_util.c
@@ -144,6 +144,36 @@ static void test_flb_aws_error()
     flb_sds_destroy(error_type);
 }
 
+static void test_flb_aws_is_auth_error()
+{
+    char *payload;
+
+    initialization_crutch();
+
+    payload = "<Error><Code>InvalidAccessKeyId</Code><Message>The AWS Access Key Id you provided does not exist in our records.</Message>"
+              "<AWSAccessKeyId>AKIATRANDOMKEY12345678</AWSAccessKeyId>"
+              "<RequestId>XZ4Y38XBV54B7GKT</RequestId>"
+              "<HostId>PEH4YGxFyd7aiREqx47Xj1SEztmklUp/9rzwrLz4A1LIWp8jQRhybogym3KhlfpCC4JD4FaRYxU=</HostId></Error>";
+    TEST_CHECK(flb_aws_is_auth_error(payload, strlen(payload)) == FLB_TRUE);
+
+    payload = "<Error>"
+              "<Code>NoSuchKey</Code>"
+              "<Message>The resource you requested does not exist</Message>"
+              "<Resource>/mybucket/myfoto.jpg</Resource>"
+              "<RequestId>4442587FB7D0A2F9</RequestId>"
+              "</Error>";
+    TEST_CHECK(flb_aws_is_auth_error(payload, strlen(payload)) == FLB_FALSE);
+
+    payload = "{\"__type\":\"ExpiredToken\",\"message\":\"The security token included in the request is expired.\"}";
+    TEST_CHECK(flb_aws_is_auth_error(payload, strlen(payload)) == FLB_TRUE);
+
+    payload = "{\"__type\":\"ValidationError\",\"message\":\"Input validation failed.\"}";
+    TEST_CHECK(flb_aws_is_auth_error(payload, strlen(payload)) == FLB_FALSE);
+
+    payload = "";
+    TEST_CHECK(flb_aws_is_auth_error(payload, strlen(payload)) == FLB_FALSE);
+}
+
 static void test_flb_aws_endpoint()
 {
     char *endpoint;
@@ -418,6 +448,7 @@ static void test_flb_get_s3_key_mixed_timestamp()
 
 TEST_LIST = {
     { "parse_api_error" , test_flb_aws_error},
+    { "flb_aws_is_auth_error", test_flb_aws_is_auth_error},
     { "flb_aws_endpoint" , test_flb_aws_endpoint},
     {"flb_get_s3_key_multi_tag_exists", test_flb_get_s3_key_multi_tag_exists},
     {"flb_get_s3_key_full_tag", test_flb_get_s3_key_full_tag},