diff --git a/backend/s3/s3.go b/backend/s3/s3.go
index eb4e4de57..0d1923673 100644
--- a/backend/s3/s3.go
+++ b/backend/s3/s3.go
@@ -1522,8 +1522,10 @@ func s3Connection(ctx context.Context, opt *Options, client *http.Client) (s3Cli
 			}
 		}
 
-		// Create AssumeRole credentials provider
-		awsConfig.Credentials = stscreds.NewAssumeRoleProvider(stsClient, opt.RoleARN, assumeRoleOptions)
+		// Create AssumeRole credentials provider, wrapped in a
+		// CredentialsCache so we don't call AssumeRole on every
+		// request.
+		awsConfig.Credentials = aws.NewCredentialsCache(stscreds.NewAssumeRoleProvider(stsClient, opt.RoleARN, assumeRoleOptions))
 	}
 
 	provider = loadProvider(opt.Provider)