title: Ways to find out how soon the AWS session expires?
body: <p><strong>Prerequisites</strong></p>
  <p>I have a script that works with AWS but does not deal with credentials explicitly. It just calls AWS API, expecting the credentials to be there according to <a href="https://docs.aws.amazon.com/sdk-for-php/v3/developer-guide/guide_credentials.html#default-credential-chain" rel="noreferrer">default credentials provider chain</a>. In fact, the wrapper that calls this script obtains temporary credentials and passes them in environment variables (<code>AWS_ACCESS_KEY_ID</code>, <code>AWS_SECRET_ACCESS_KEY</code> and <code>AWS_SESSION_TOKEN</code>).</p>
  <p><strong>Problem</strong></p>
  <p>The wrapper usually reuses existing credentials, and only asks to re-authenticate explicitly when they are about to expire. So there is a possibility that it passes credentials that have a few minutes left to live, which may not be enough, as the script execution usually takes long time. Unfortunately, I don't have control over the wrapper, so I would like to make the script check how much time it has left before making a decision whether to start or abort early to prevent failure in mid-flight.</p>
  <p>AWS doesn't seem provide a standard way to query &quot;how much time I have before my current session expires?&quot; If I had control over the wrapper, I would make it pass the expiry date in an environment variable as well. I was hoping that <code>AWS_SESSION_TOKEN</code> is a sort of a JWT token, but unfortunately it is not, and does not seem to contain any timestamp in it.</p>
  <p>Can anyone suggest any other ways around the given problem?</p>