I have a utility aws-export-credentials to allow AWS credentials to be retrieved in a variety of formats, like as environment variables. Adding this functionality to the AWS CLI is open as aws/aws-cli#4668. The CLI caches credentials from, for example, assume role profiles. This would be nice for the "export credentials" functionality, but the Credentials class and ReadOnlyCredentials do not expose expiration as a public field.

I propose adding expiration as a public field to both Credentials and ReadOnlyCredentials, of type datetime.datetime, with None if there is no known expiration (the default implementation in the base Credentials class). RefreshableCredentials would return its existing _expiry_time.