All that should just happen. Unless it is FedRAMP or something insane like that.

I have set my own cli credentials ttl to 8 hours and require 2FA to refresh. Once daily works fine for me. It all takes ~30 seconds, really.