You need to make a fountain that releases and replenishes fresh tokens on demand.
Example GitHub - duomark/epocxy: Erlang Patterns of Concurrency · GitHub
You need to have a pool of one-shot processes that expire and you need to dynamically populate them / expire them based on load
Alternatively if you can eat the latency then only make them when you need.
Also note once you have created STS credentials they will expire, if this is not appropriate then change your design.
For S3 link signing purposes, for displaying images in a browser, it is not necessary to sign the URL with STS tokens.
I speculate you will find it useful to use browser cache in the normal way e.g. GET /images/1 → GET signed s3 link (HTTP 302 redirect) with 24h cache expiry.
