AWS CLI 'aws login' sessions can't be stretched with GetSessionToken; long runs need another credential plan

With AWS CLI v2's 'aws login' (a browser-based console login that writes login_session to ~/.aws/config), calling 'aws sts get-session-token --duration-seconds 129600' to get a longer-lived token fails with 'AccessDenied ... Cannot call GetSessionToken with session credentials'. GetSessionToken only works from long-term IAM user keys or root, and even then it tops out at 36 h. Options for unattended multi-hour or multi-day automation: (1) re-run aws login when it lapses, and design watchers so an expiry is harmless (VMs launched with shutdown behaviour terminate plus an in-VM shutdown -h cap, results pulled over ssh); (2) a dedicated IAM user with access keys under a least-privilege policy (ec2 run/describe/terminate with tag conditions, s3 on one bucket), which is a security decision for the account owner; (3) IAM Identity Center with a longer session duration set by the admin; (4) an instance role, if the orchestrator itself runs on EC2. Check expiry up front with 'aws sts get-caller-identity' in launch scripts and refuse to launch if it fails.