title: Using aws STS to get temporary credentials: Where is the web identity token?
body: <p>My users login to my application through a microservice that connects to cognito (the request is proxied via API gateway)</p>
  
  <p>They get a session token.</p>
  
  <p>Once logged in, they need to put some files to S3.</p>
  
  <p>I want to give them temporary credentials using STS but to call <code>sts.AssumeRoleWithWebIdentity</code> I need a web identity token.</p>
  
  <p>How can I get a web identity token with a session token as input?</p>
  
  <p>I wrote a temporary lambda (node) that returns STS credentials upon logging with a username and password:</p>
  
  <pre><code>const cognitoidentityserviceprovider = new AWS.CognitoIdentityServiceProvider();
  const cognitoidentity = new AWS.CognitoIdentity();
  cognitoidentityserviceprovider.initiateAuth(...) //AuthFlow: 'USER_PASSWORD_AUTH'
      cognitoidentity.getId(...)
          cognitoidentity.getCredentialsForIdentity(...)
  </code></pre>
  
  <p>There can be some time between the login and the file upload and I don't want the user to submit user/password each time. There's no AuthFlow accepting a session token either.</p>
  
  <p>I'm guessing the API Gateway could return something useful but I didn't find anything in the docs:
  <a href="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-mapping-template-reference.html#context-variable-reference" rel="nofollow noreferrer">https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-mapping-template-reference.html#context-variable-reference</a></p>