I am running a DuckDB job in an AWS Fargate container. It is accessing .parquet files on S3 through the DuckLake extension. The container assumes an IAM role which DuckDB can access via CREATE SECRET (TYPE S3, provider credential_chain);. This works as expected and S3 is accessed via temporary credentials from the assumed role.

However, this does not seem to be refreshing the credentials correctly. For long running tasks it starts failing after 6h due to expiring credentials. Is there a way to convince DuckDB to automatically refresh credentials? The only way I could get it to work was closing the connection, recreating the secret and reconnecting.
There must be a better way.