Temporary STS credentials can be stored in **credentials** file, per https://docs.aws.amazon.com/credref/latest/refdocs/creds-config-files.html s3i service can take care of that in background