@@ -17,6 +17,26 @@ import sys

 import json

 from . import Progress

 from .SortedDict import SortedDict

+import datetime

+from .ExitCodes import EX_OSFILE

+

+try:

+    import dateutil.parser

+except ImportError:

+    sys.stderr.write(u"""

+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

+ImportError trying to import dateutil.parser.

+Please install the python dateutil module:

+$ sudo apt-get install python-dateutil

+  or

+$ sudo yum install python-dateutil

+  or

+$ pip install python-dateutil

+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

+""")

+    sys.stderr.flush()

+    sys.exit(EX_OSFILE)

+

 try:

     # python 3 support

     import httplib

@@ -54,6 +74,12 @@ def config_unicodise(string, encoding = "utf-8", errors = "replace"):

     except UnicodeDecodeError:

         raise UnicodeDecodeError("Conversion to unicode failed: %r" % string)

+def config_date_to_python(date):

+    """

+    Convert a string formated like '2020-06-27T15:56:34Z' into a python datetime 

+    """

+    return dateutil.parser.parse(date, fuzzy=True)

+

 def is_bool_true(value):

     """Check to see if a string is true, yes, on, or 1

@@ -94,6 +120,8 @@ class Config(object):

     secret_key = u""

     access_token = u""

     _access_token_refresh = True

+    _access_token_expiration = None

+    _access_token_last_update = None

     host_base = u"s3.amazonaws.com"

     host_bucket = u"%(bucket)s.s3.amazonaws.com"

     kms_key = u""    #can't set this and Server Side Encryption at the same time

@@ -273,7 +301,7 @@ class Config(object):

         Get credentials from IAM authentication

         """

         try:

-            conn = httplib.HTTPConnection(host='169.254.169.254', timeout = 2)

+            conn = httplib.HTTPConnection(host='169.254.169.254', timeout=2)

             conn.request('GET', "/latest/meta-data/iam/security-credentials/")

             resp = conn.getresponse()

             files = resp.read()

@@ -286,6 +314,11 @@ class Config(object):

                     Config().update_option('access_key', config_unicodise(creds['AccessKeyId']))

                     Config().update_option('secret_key', config_unicodise(creds['SecretAccessKey']))

                     Config().update_option('access_token', config_unicodise(creds['Token']))

+                    expiration = config_date_to_python(config_unicodise(creds['Expiration']))

+                    # Add a timedelta to prevent any expiration if the EC2 machine is not at the right date

+                    self._access_token_expiration = expiration - datetime.timedelta(minutes=15)

+                    self._access_token_last_update = config_date_to_python(config_unicodise(creds['LastUpdated']))

+                    # Others variables : Code / Type

                 else:

                     raise IOError

             else:

@@ -295,6 +328,13 @@ class Config(object):

     def role_refresh(self):

         if self._access_token_refresh:

+            now = datetime.datetime.now(datetime.timezone.utc)

+            if self._access_token_expiration \

+               and now < self._access_token_expiration \

+               and self._access_token_last_update \

+               and self._access_token_last_update <= now:

+                # current token is still valid. No need to refresh it

+                return

             try:

                 self.role_config()

             except Exception: