"credential_source=Ec2InstanceMetadata" workaround

.aws_config

[profile target-account]
role_arn = arn:aws:iam::123456789012:role/RoleInTargetAccount
source_profile = instance-role
region = eu-central-1

.aws_credentials

[instance-role]
aws_access_key_id=
aws_secret_access_key=
aws_session_token=

fetch-ec2-credentials.py

#!/usr/bin/env python3

import os
import urllib.request
import json
import configparser

CREDENTIALS_FILE = '~/.aws/credentials'
PROFILE_NAME = 'instance-role'

# Retrieve the first instance role
response = urllib.request.urlopen('http://169.254.169.254/latest/meta-data/iam/security-credentials/')
role_name = response.read().decode('utf-8').split('\n')[0]

# Retrieve the credentials for said role
response = urllib.request.urlopen('http://169.254.169.254/latest/meta-data/iam/security-credentials/' + role_name)
credentials = json.load(response)

# Update credentials file
full_path = os.path.expanduser(CREDENTIALS_FILE)
config = configparser.ConfigParser()
config.read(full_path)
config[PROFILE_NAME] = {'aws_access_key_id': credentials['AccessKeyId'], 'aws_secret_access_key': credentials['SecretAccessKey'], 'aws_session_token': credentials['Token']}
with open(full_path, 'w') as file:
    config.write(file)