Expiration time of AWS EC2 instance profile credentials

Question

The official AWS documentation states that instance profile credentials "are temporary and would eventually expire" , and I was wondering how often they expire.

I'am asking because I have applications using an InstanceProfileCredentialsProvider as credential provider, which by default does not refresh credentials, running for days without problems.

Answer 1

We have noticed from logging that the temporary credentials issued against an attached role last approximately 6 hours.

Does anyone know the mechanism of how they are refreshed, supposedly 15 minutes before they expire? Is the SSM service monitoring the expiration and asking for new credentials?

We are currently chasing down what appears to be an issue with the credentials not being refreshed after the EC2 instance has no activity on the overnight. Trying to determine whether app pool idle timeout or recycle interval is playing a hand.