AWS credentials
For every AWS access method, Freeleapp requests temporary credentials from AWS STS and rotates them every 20 minutes while the session is active. Long-term credentials are never written to ~/.aws/credentials.
IAM Role Federated
Section titled “IAM Role Federated”Credentials come from AssumeRoleWithSAML. AWS allows 15 minutes up to the role’s maximum session duration (1 to 12 hours), capped by the SAML response’s SessionNotOnOrAfter.
Freeleapp requests 1 hour. These credentials are not cached in the keychain.
IAM Role Chained
Section titled “IAM Role Chained”Credentials come from AssumeRole, called with the assumer session’s credentials. Freeleapp does not pass DurationSeconds, so they last 1 hour (AWS limits role chaining to 1 hour anyway).
IAM User
Section titled “IAM User”Credentials come from GetSessionToken, signed with the user’s long-term keys from the keychain (and your MFA code, if configured). AWS allows 15 minutes to 36 hours.
Freeleapp requests 10 hours. These are the only temporary credentials cached in the keychain; they are reused until they expire, so you are not asked for an MFA code on every rotation.
IAM Identity Center
Section titled “IAM Identity Center”Credentials come from the Identity Center GetRoleCredentials API, using the access token obtained when you log in to the integration. That token is kept in the keychain and lasts 8 hours; after that, log in again.