aws login - no refresh?

[devurandom]

Describe the bug

The documentation of aws login claims that the tokens will be automatically refreshed:

• "Each time the login command is called, the CLI will acquire temporary credentials and a refresh token that correspond to your selected console session. The CLI will refresh the temporary credentials automatically as long as the refresh token is valid." (https://docs.aws.amazon.com/cli/latest/reference/login/#description)
• "[...] this will automatically generate temporary credentials. The CLI will automatically refresh these credentials for up to 12 hours." (https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sign-in.html)
• "The AWS CLI and SDKs will automatically refresh the cached credentials every 15 minutes as needed. The overall session will be valid for up to the set session duration of the IAM principal (maximum of 12 hours), after which you must run aws login again." (https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sign-in.html#cli-configure-sign-in-with-profile)

However, it is unclear to me how that automatic refresh is happening. There is no systemd user service or even a background process, as far as I can see, that could accomplish this.

The resulting effect I see is that the tokens expire constantly, every few minutes (<<1h) I have to run aws login again.

Regression Issue

• Select this option if this issue appears to be a regression.

Expected Behavior

• Documentation on how to control the background process that keeps refreshing the tokens, preferably using a systemd user service.
• Documentation how to manually trigger a token refresh, in case the automatic background process does not work, allowing people to set up systemd user timers themselves.

Current Behavior

• I cannot find documentation on how the automatic token refresh is being executed.
• I cannot find documentation on how to refresh the token manually.
• The token refresh does not appear to work: Tokens expire constantly in <<1h and I have to aws login again.

Reproduction Steps

aws login, wait for significantly less than 1h, run an aws command, notice that tokens are expired, run aws login again, repeat

Possible Solution

Both should provided:

• Documentation on how to control the background process that keeps refreshing the tokens, preferably using a systemd user service.
• Documentation how to manually trigger a token refresh, in case the automatic background process does not work, allowing people to set up systemd user timers themselves.

Additional Information/Context

No response

CLI version used

aws-cli/2.36.0 Python/3.14.6 Linux/7.1.6-201.fc44.x86_64 source/x86_64.fedora.44

Environment details (OS name and version, etc.)

aws-cli/2.36.0 Python/3.14.6 Linux/7.1.6-201.fc44.x86_64 source/x86_64.fedora.44