I have set my own cli credentials ttl to 8 hours and require 2FA to refresh. Once daily works fine for me. It all takes ~30 seconds, really.