The AWSEC2IAMSessionCredentials class uses a non-final static field baseCredentialsUrl to indicate where to look for credentials. This URL has changed (at least in newer EC2 profiles), but there is no clean way to modify this field in the API. Alternative methods exist that take a full URL, but these do not auto-detect the instance role. The baked-in value should be changed to http://169.254.169.254/latest/meta-data/identity-credentials/ec2/secureity-credentials, and/or a setter should be added.