It looks like the plugin creates a new s3 client for every call/request. And this new client in turn creates its own instance of the default credentials provider if AWS credentials are not explicitly configured. If running on an EC2 instances, with high throughput, we believe that this is resulting in making a large number of requests to the IMDS service to fetch the current credentials for the instance, which can result in hitting the rate limit for the endpoint. When that happens, attempts to get credentials fail. To avoid this, it is recommended to share a single s3 client across all requests, rather than constructing a new one every time.