The Unholy Marriage of AWS IAM Roles and Instance Profiles – Uptycs TL;DR   EC2 instances continue to use role credentials for up to six hours—even after removing a role from the instance profile. Swapping roles can result in credential discrepancies of up to 54 minutes. Forcing a credential refresh requires deleting the role, revoking sessions for more than six hours, stopping/starting the instance, or associating a new instance profile...