All application API requests to Amazon Web Services (AWS) must be cryptographically signed using credentials issued by AWS.

If your application uses temporary credentials when creating an AWS client (such as an AmazonSQS client), the credentials expire at the time interval specified during their creation. You must make sure that the credentials are refreshed before they expire.

Another reason for expiration is using the incorrect time. A consistent and accurate time reference is crucial for many server tasks and processes. If your instance's date and time aren't set correctly, the AWS credentials might be rejected.

If your application is running on an Amazon EC2 instance, we recommend using an AWS Identity and Access Management (IAM) role assigned to the instance. Using an IAM role allows the use of a default service constructor. The default constructor client searches for credentials by using the default credentials provider chain, in the following order:

1. In system environment variables: AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY.
2. In the Java system properties: aws.accessKeyId and aws.secretKey.
3. In the default credentials file (the location of this file varies by platform).
4. In the instance profile credentials contained in the instance metadata associated with the IAM role for the EC2 instance. Instance profile credentials are added to the default credentials provider chain when you attach an
   instance profile to your instance. For more information, see Using an IAM Role to Grant Permissions to Applications Running on Amazon EC2 Instances.

If instance profile credentials are available, the default client constructor creates an instance of the AWS SDK InstanceProfileCredentialsProvider class. This class is used to sign API requests with AWS credentials using temporary security credentials from Amazon EC2 instance metadata.

Important: If your application uses the AWS SDK ProfileCredentialsProvider class to provide temporary AWS credentials, you are responsible for checking for and refreshing credentials before they expire. Not checking or refreshing your credentials can increase the likelihood of application failures caused by ExpiredToken errors.