Answers: <p>I've done this in a bash script and read three of the four elements in the <code>awscli</code> output to set in environment variables for a later <code>awscli</code> command.</p>
  <p>It uses <code>jq</code> to extract the individual values from the JSON reply, something like this:</p>
  <pre><code># get session credentials via sts assume-role
  ar_json=$(
      aws sts assume-role \
        --role-arn &quot;${role_arn}&quot; \
        --duration-seconds ${session_secs} \
        --role-session-name what-im-doing-$$
  )
  
  # now extract the items into environment variables for my main command
  export AWS_SESSION_TOKEN=$(jq -rM '.Credentials.SessionToken' &lt;&lt;&lt;&quot;${ar_json}&quot;)
  export AWS_ACCESS_KEY_ID=$(jq -rM '.Credentials.AccessKeyId' &lt;&lt;&lt;&quot;${ar_json}&quot;)
  export AWS_SECRET_ACCESS_KEY=$(jq -rM '.Credentials.SecretAccessKey' &lt;&lt;&lt;&quot;${ar_json}&quot;)
  
  # my main command that needs the role permissions
  aws s3 sync &quot;${bucket_url}&quot; &quot;${local_dir}&quot;
  </code></pre>
  <p>There's some error checking I've omitted to keep the example simple.
  The <code>-r</code> option tells <code>jq</code> to not put quotes around its output, and the <code>-M</code> option tells <code>jq</code> to not colorize its output.</p>
  <p>Putting these credentials into environment variables carries a risk of exposing them to someone on the same host who is using <code>ps</code> with options to view process environments.  The session credentials may expire quickly enough to not worry about it.</p>
  <p>A more secure way to pass the credentials to your <code>awscli</code> commands would be through writing them to configuration files, as another answer suggested.</p>
  
Answers: CC BY-SA 4.0
Answers: 2022-08-30T09:27:53.427Z
Answers: 2022-08-30T16:35:13.307Z
Answers: 2022-08-30T16:35:13.307Z
Answers: Sotto Voce
Answers: <p>The answer was to ignore everything in the JSON except the &quot;SessionToken&quot;.
  To use the session token, either add this to the credentials file profile with the same AWS keys, or export it as an env var</p>
  <p>aws_session_token = XXXXXXXXXXXXXXXXXXXXXXXX</p>
  
Answers: CC BY-SA 4.0
Answers: 2021-12-02T17:49:30.383Z
Answers: 2021-12-02T17:49:30.383Z
Answers: ahoffer
Body: <p>I'm setting up my AWS CLI. To access to AWS services like EC2, I have to switch roles.</p>
  <p>I used the command <code>aws sts assume-role</code>, and it spit out JSON with <code>Credentials</code> and <code>AssumedRoleUser</code>, complete with a session token. That's great!</p>
  <p>Now what? I've googled around, but I cannot figure what to do with generated JSON.
  How do I tell AWS CLI, &quot;Use this JSON to authenticate with this role&quot;?</p>
  <p>Here is the (redacted) JSON I have:</p>
  <pre><code>{
      &quot;Credentials&quot;: {
          &quot;AccessKeyId&quot;: &quot;XXXXXXXXXXW5YABBKUXQ&quot;,
          &quot;SecretAccessKey&quot;: &quot;XXXXXXXXXXXXXXXXXXXXB2EFEUmCtuwbJPcMBF02&quot;,
          &quot;SessionToken&quot;: &quot;XXXXXXXXXXsi6md6PTNHYjHUljav&quot;,
          &quot;Expiration&quot;: &quot;2021-12-03T04:59:02+00:00&quot;
      },
      &quot;AssumedRoleUser&quot;: {
          &quot;AssumedRoleId&quot;: &quot;XXXXXXXXXX:dev&quot;,
          &quot;Arn&quot;: &quot;arn:aws-us-gov:sts::999999999991:assumed-role/PROJADMIN/dev&quot;
      }
  }
  </code></pre>
  
Tags: <amazon-web-services><aws-cli>
Title: AWS CLI and a JSON file
UserDisplayName: ahoffer
ThreadText: # AWS CLI and a JSON file
  
  (Asked by: username_0 on 2021-12-02)
  
  I'm setting up my AWS CLI. To access to AWS services like EC2, I have to switch roles.
  
  I used the command `aws sts assume-role`, and it spit out JSON with `Credentials` and `AssumedRoleUser`, complete with a session token. That's great!
  
  Now what? I've googled around, but I cannot figure what to do with generated JSON.
  How do I tell AWS CLI, "Use this JSON to authenticate with this role"?
  
  Here is the (redacted) JSON I have:
  
  ```
  {
      "Credentials": {
          "AccessKeyId": "XXXXXXXXXXW5YABBKUXQ",
          "SecretAccessKey": "XXXXXXXXXXXXXXXXXXXXB2EFEUmCtuwbJPcMBF02",
          "SessionToken": "XXXXXXXXXXsi6md6PTNHYjHUljav",
          "Expiration": "2021-12-03T04:59:02+00:00"
      },
      "AssumedRoleUser": {
          "AssumedRoleId": "XXXXXXXXXX:dev",
          "Arn": "arn:aws-us-gov:sts::999999999991:assumed-role/PROJADMIN/dev"
      }
  }
  
  ```
  
  **Tags:** amazon-web-services, aws-cli
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2022-08-30. Score: 0 | Accepted answer
  
  I've done this in a bash script and read three of the four elements in the `awscli` output to set in environment variables for a later `awscli` command.
  
  It uses `jq` to extract the individual values from the JSON reply, something like this:
  
  ```
  # get session credentials via sts assume-role
  ar_json=$(
      aws sts assume-role \
        --role-arn "${role_arn}" \
        --duration-seconds ${session_secs} \
        --role-session-name what-im-doing-$$
  )
  
  # now extract the items into environment variables for my main command
  export AWS_SESSION_TOKEN=$(jq -rM '.Credentials.SessionToken' <<<"${ar_json}")
  export AWS_ACCESS_KEY_ID=$(jq -rM '.Credentials.AccessKeyId' <<<"${ar_json}")
  export AWS_SECRET_ACCESS_KEY=$(jq -rM '.Credentials.SecretAccessKey' <<<"${ar_json}")
  
  # my main command that needs the role permissions
  aws s3 sync "${bucket_url}" "${local_dir}"
  
  ```
  
  There's some error checking I've omitted to keep the example simple.
  The `-r` option tells `jq` to not put quotes around its output, and the `-M` option tells `jq` to not colorize its output.
  
  Putting these credentials into environment variables carries a risk of exposing them to someone on the same host who is using `ps` with options to view process environments. The session credentials may expire quickly enough to not worry about it.
  
  A more secure way to pass the credentials to your `awscli` commands would be through writing them to configuration files, as another answer suggested.
  
  
  ---
  
  ### Answer by username_0 on 2021-12-02. Score: 1
  
  The answer was to ignore everything in the JSON except the "SessionToken".
  To use the session token, either add this to the credentials file profile with the same AWS keys, or export it as an env var
  
  aws\_session\_token = XXXXXXXXXXXXXXXXXXXXXXXX
  
  
  ---
  
  