fetch creds from IAM metadata if missing or expiring / expired