<p>I've done this in a bash script and read three of the four elements in the <code>awscli</code> output to set in environment variables for a later <code>awscli</code> command.</p>
<p>It uses <code>jq</code> to extract the individual values from the JSON reply, something like this:</p>
<pre><code># get session credentials via sts assume-role
ar_json=$(
    aws sts assume-role \
      --role-arn &quot;${role_arn}&quot; \
      --duration-seconds ${session_secs} \
      --role-session-name what-im-doing-$$
)

# now extract the items into environment variables for my main command
export AWS_SESSION_TOKEN=$(jq -rM '.Credentials.SessionToken' &lt;&lt;&lt;&quot;${ar_json}&quot;)
export AWS_ACCESS_KEY_ID=$(jq -rM '.Credentials.AccessKeyId' &lt;&lt;&lt;&quot;${ar_json}&quot;)
export AWS_SECRET_ACCESS_KEY=$(jq -rM '.Credentials.SecretAccessKey' &lt;&lt;&lt;&quot;${ar_json}&quot;)

# my main command that needs the role permissions
aws s3 sync &quot;${bucket_url}&quot; &quot;${local_dir}&quot;
</code></pre>
<p>There's some error checking I've omitted to keep the example simple.
The <code>-r</code> option tells <code>jq</code> to not put quotes around its output, and the <code>-M</code> option tells <code>jq</code> to not colorize its output.</p>
<p>Putting these credentials into environment variables carries a risk of exposing them to someone on the same host who is using <code>ps</code> with options to view process environments.  The session credentials may expire quickly enough to not worry about it.</p>
<p>A more secure way to pass the credentials to your <code>awscli</code> commands would be through writing them to configuration files, as another answer suggested.</p>

CC BY-SA 4.0
2022-08-30T09:27:53.427Z
2022-08-30T16:35:13.307Z
2022-08-30T16:35:13.307Z
Sotto Voce
<p>The answer was to ignore everything in the JSON except the &quot;SessionToken&quot;.
To use the session token, either add this to the credentials file profile with the same AWS keys, or export it as an env var</p>
<p>aws_session_token = XXXXXXXXXXXXXXXXXXXXXXXX</p>

CC BY-SA 4.0
2021-12-02T17:49:30.383Z
2021-12-02T17:49:30.383Z
ahoffer
<p>I'm setting up my AWS CLI. To access to AWS services like EC2, I have to switch roles.</p>
<p>I used the command <code>aws sts assume-role</code>, and it spit out JSON with <code>Credentials</code> and <code>AssumedRoleUser</code>, complete with a session token. That's great!</p>
<p>Now what? I've googled around, but I cannot figure what to do with generated JSON.
How do I tell AWS CLI, &quot;Use this JSON to authenticate with this role&quot;?</p>
<p>Here is the (redacted) JSON I have:</p>
<pre><code>{
    &quot;Credentials&quot;: {
        &quot;AccessKeyId&quot;: &quot;XXXXXXXXXXW5YABBKUXQ&quot;,
        &quot;SecretAccessKey&quot;: &quot;XXXXXXXXXXXXXXXXXXXXB2EFEUmCtuwbJPcMBF02&quot;,
        &quot;SessionToken&quot;: &quot;XXXXXXXXXXsi6md6PTNHYjHUljav&quot;,
        &quot;Expiration&quot;: &quot;2021-12-03T04:59:02+00:00&quot;
    },
    &quot;AssumedRoleUser&quot;: {
        &quot;AssumedRoleId&quot;: &quot;XXXXXXXXXX:dev&quot;,
        &quot;Arn&quot;: &quot;arn:aws-us-gov:sts::999999999991:assumed-role/PROJADMIN/dev&quot;
    }
}
</code></pre>

<amazon-web-services><aws-cli>
AWS CLI and a JSON file
ahoffer
# AWS CLI and a JSON file

(Asked by: username_0 on 2021-12-02)

I'm setting up my AWS CLI. To access to AWS services like EC2, I have to switch roles.
I used the command aws sts assume-role, and it spit out JSON with Credentials and AssumedRoleUser, complete with a session token. That's great!
Now what? I've googled around, but I cannot figure what to do with generated JSON.
How do I tell AWS CLI, "Use this JSON to authenticate with this role"?
Here is the (redacted) JSON I have:
{
    "Credentials": {
        "AccessKeyId": "XXXXXXXXXXW5YABBKUXQ",
        "SecretAccessKey": "XXXXXXXXXXXXXXXXXXXXB2EFEUmCtuwbJPcMBF02",
        "SessionToken": "XXXXXXXXXXsi6md6PTNHYjHUljav",
        "Expiration": "2021-12-03T04:59:02+00:00"
    },
    "AssumedRoleUser": {
        "AssumedRoleId": "XXXXXXXXXX:dev",
        "Arn": "arn:aws-us-gov:sts::999999999991:assumed-role/PROJADMIN/dev"
    }
}

**Tags:** amazon-web-services, aws-cli


---

## 2 answers

### Answer by username_1 on 2022-08-30. Score: 0 | Accepted answer

I've done this in a bash script and read three of the four elements in the awscli output to set in environment variables for a later awscli command.
It uses jq to extract the individual values from the JSON reply, something like this:
# get session credentials via sts assume-role
ar_json=$(
    aws sts assume-role \
      --role-arn "${role_arn}" \
      --duration-seconds ${session_secs} \
      --role-session-name what-im-doing-$$
)

# now extract the items into environment variables for my main command
export AWS_SESSION_TOKEN=$(jq -rM '.Credentials.SessionToken' <<<"${ar_json}")
export AWS_ACCESS_KEY_ID=$(jq -rM '.Credentials.AccessKeyId' <<<"${ar_json}")
export AWS_SECRET_ACCESS_KEY=$(jq -rM '.Credentials.SecretAccessKey' <<<"${ar_json}")

# my main command that needs the role permissions
aws s3 sync "${bucket_url}" "${local_dir}"

There's some error checking I've omitted to keep the example simple.
The -r option tells jq to not put quotes around its output, and the -M option tells jq to not colorize its output.
Putting these credentials into environment variables carries a risk of exposing them to someone on the same host who is using ps with options to view process environments.  The session credentials may expire quickly enough to not worry about it.
A more secure way to pass the credentials to your awscli commands would be through writing them to configuration files, as another answer suggested.


---

### Answer by username_0 on 2021-12-02. Score: 1

The answer was to ignore everything in the JSON except the "SessionToken".
To use the session token, either add this to the credentials file profile with the same AWS keys, or export it as an env var

aws\_session\_token = XXXXXXXXXXXXXXXXXXXXXXXX


---

