Update (2026): This article documents a legacy approach and is preserved for historical and educational purposes. AWS now recommends temporary credentials through IAM Identity Center for human access and local development, and IAM roles for workloads, instead of long-term IAM user access keys whenever possible.
The 12-hour expiration described below applied to temporary credentials or an organization-specific setup; IAM user access keys do not expire automatically. The original script also deletes the oldest key before validating the replacement and overwrites the default profile in .aws/credentials. Do not use it unchanged in a production environment. A safer rotation flow is: create the new key, configure and test it, deactivate the old key, verify that it is no longer used, and only then delete it.
Context
Provided IAM access keys were set to expire in 12 hours. Developing locally constantly resulted in Token expired exceptions.
Solution
