boto/boto — pull request #962 by jamesls (2012-09-04 18:02:16+00:00)
Title: Refresh credentials based on expiry time, fixes #898

This pull request changes the way that IAM role credentials
are refreshed. The current approach is "reactive", that is
whenever we get a service response back, if it looks like
a "credentials are expired" response, we refresh the credentials.

The problem with this is that not all services return a consistent
"credentials are expired" response, and services may change what
response they return at any time.

This new approach is "proactive" based on the expiration time
associated with the IAM role credentials. Whenever the credentials
are accessed (via the Provider) object, the expiration time
(if applicable) is checked, and if the credentials are going to
expire in 5 minutes or less, a new set of credentials are retrieved.
This is the same approach that is used by the AWS SDK for Java.

In testing this, I verified that I correctly see credentials refreshing
for s3/sqs (two services explicitly mentioned in #898).