Comment by flyt

AWS best practices is to use AWS SSO, which accomplishes this same effect but without any long-lived local credentials. It works really well.