Any progress here, or any way I can help there be progress? It appears we have a straightforward conflict between --s3-profile and --s3-endpoint.
Also looks like if we could get the two working together it might solve the long session problem posted here via the caching mechanism.
It looks like using --s3-profile (without an explicit private endpoint) does indeed refresh creds which is cool ... but using private endpoints is a security essential.