Per the documentation, aws configure get "only looks at values in the AWS configuration file". The actual scope appears to be anything stored in the ~/.aws folder. E.g., with the SSO I use, the expiration is stored inside ~/.aws/credentials file as aws_expiration, per profile. So I can either parse the file or use aws configure get aws_expiration to retrieve the value