title: AWS Cognito Identity Pool: AWS Credentials Expiration / Renewal
body: <p>I'm building an AWS-backed site which, broadly speaking, does the following:</p>
  
  <ol>
  <li>Authenticates a user against a Cognito User Pool (the pool is backed by a third-party SAML provider), giving them tokens.</li>
  <li>Uses a Cognito Identity Pool to grant the user credentials for use with other services.</li>
  <li>Lets the user perform a series of long-running S3 uploads, directly from the front-end S3 client, using the credentials from above.</li>
  </ol>
  
  <p>I'm trying to get clarity on the interactions I will have to have with tokens and credentials. I'm pretty clear on what I have to do with <a href="https://docs.amazonaws.cn/en_us/cognito/latest/developerguide/amazon-cognito-user-pools-using-tokens-with-identity-providers.html" rel="nofollow noreferrer">the tokens I get from the user pool</a>:</p>
  
  <ol>
  <li>I can use them to call the Identity Pool, and get AWS credentials I can use for S3.</li>
  <li>I can use the refresh token to refresh the other tokens if they expire before I'm done.</li>
  </ol>
  
  <p>The expiration details for these tokens are in the link above. The documentation is pretty clear on all of the above, but I'm confused about the Identity Pool credential functionality, and haven't been able to find explanations in the docs on the following questions:</p>
  
  <ol>
  <li>When I get AWS credentials from my Identity Pool, how long will they last before expiring? How can I configure this value, so that my <a href="https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/CognitoIdentityCredentials.html" rel="nofollow noreferrer"><code>CognitoIdentityCredentials</code></a> gives me credentials with my desired expiration?</li>
  <li>If my AWS credentials expire before I'm done with my work, what's the right logic for attempting to 1. refresh the credentials and 2. if that fails, refresh the user pool tokens, so as to be able to complete the operation cleanly without making the user restart it?</li>
  </ol>