Why are the STS credentials getting expired within 45 minutes?

Question

I have this setup where my Ansible playbook runs, which runs an ML script which takes around 3-4 hours for execution, and some AWS tasks running after the ML script.

So, I am running a background updatecredentials.py python file which updates both the /home/ubuntu/.aws/config and the file from where my AWS takes credentials from. This file runs every 45 minutes.

The updates are as follows:

For the first instance of the run, the stat of the config file is as follows:

  File: ‘/home/ubuntu/.aws/config’
  Size: 480         Blocks: 8          IO Block: 4096   regular file
Device: ca01h/51713d    Inode: 275461      Links: 1
Access: (0664/-rw-rw-r--)  Uid: ( 1000/  ubuntu)   Gid: ( 1000/  ubuntu)
Access: 2017-08-09 09:53:20.600856000 +0000
Modify: 2017-08-09 09:53:18.804856000 +0000
Change: 2017-08-09 09:53:18.804856000 +0000

For the second instance, it is:

  File: ‘/home/ubuntu/.aws/config’
  Size: 480         Blocks: 8          IO Block: 4096   regular file
Device: ca01h/51713d    Inode: 275461      Links: 1
Access: (0664/-rw-rw-r--)  Uid: ( 1000/  ubuntu)   Gid: ( 1000/  ubuntu)
Access: 2017-08-09 12:10:29.072856000 +0000
Modify: 2017-08-09 10:38:18.892856000 +0000
Change: 2017-08-09 10:38:18.892856000 +0000

So, the nohup is working. However, I get the error in the .err file of the nohup code as:

botocore.exceptions.ClientError: An error occurred (ExpiredToken) when calling the AssumeRole operation: The security token included in the request is expired

And when I did stat to the creds.err file, it shows:

  File: ‘creds.err’
  Size: 594         Blocks: 8          IO Block: 4096   regular file
Device: ca01h/51713d    Inode: 275463      Links: 1
Access: (0664/-rw-rw-r--)  Uid: ( 1000/  ubuntu)   Gid: ( 1000/  ubuntu)
Access: 2017-08-09 12:04:49.952856000 +0000
Modify: 2017-08-09 11:23:18.940856000 +0000
Change: 2017-08-09 11:23:18.940856000 +0000
 Birth: -

Does this mean that my STS[/temporary] credentials expired within 45 minutes?

Your credentials should expire in an hour. That's the default and the maximum. — Oluwafemi Sule, Aug 09 '17 at 15:13
@OluwafemiSule I know that. That's exactly why I'm asking this question :) — Dawny33, Aug 09 '17 at 15:22
See https://stackoverflow.com/questions/45539658/how-to-increase-the-duration-of-sts-credentials-validity-from-one-hour?rq=1 — Oluwafemi Sule, Aug 09 '17 at 16:08

Why are the STS credentials getting expired within 45 minutes?

0 Answers0