More detail
When something uses a role, AWS STS (Security Token Service) issues an access key, a secret key and a session token that expire, typically within hours. The SDK refreshes them for you. No long-lived keys get saved anywhere.
Temporary credentials
Short-lived AWS keys handed out for a role, which expire automatically.
Think of it as: A wristband that's only valid for today.
What to know for Level 0
- Temporary credentials expire on their own, and the SDK refreshes them; nothing long-lived is stored. On EC2, the SDK fetches them from the instance metadata service at
169.254.169.254.