How do I use the AWS CLI to get temporary credentials for an IAM Identity Center user?

Short description

To generate temporary credentials, you must run the get-role-credentials command. When you configure a named profile to use IAM Identity Center, the AWS Command Line Interface (AWS CLI) creates a JSON file in the cd ~/.aws/sso/cache directory. The JSON file contains a JSON web token (JWT) that's used to get the temporary security credentials with the get-role-credentials command. The access token is valid for 8 hours. The expiresAt timestamp in the JSON file shows the expiration time.

Resolution

Note: If you receive errors when you run AWS CLI commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

Get the temporary credentials

Complete the following steps:

1. Open the following JSON file, and then locate the access token:

   cat 535a8450b05870c9045c8a7b95870.json
   {"startUrl": "https://my-sso-portal.awsapps.com/start", "region": "us-east-1", "accessToken": "eyJlbmMiOiJBM….", "expiresAt": "2020-06-17T10:02:08UTC"}

2. Copy the accessToken value.

3. Run the following get-role-credentials command to get credentials for the Identity Center user:

   aws sso get-role-credentials --account-id 123456789012 --role-name permission-set-name --access-token eyJlbmMiOiJBM…. --region enter_the_same_sso_region_same_in_the_JSON_file

   Note: Replace enter_the_same_sso_region_same_in_the_JSON_file with the AWS Region from your JSON file and permission-set-name with your role name. If you use the incorrect role name, then you receive the error "An error occurred (ForbiddenException) when calling the GetRoleCredentials operation: No access." If the session token or Region doesn't match the JSON file output, then you receive the error "An error occurred (UnauthorizedException) when calling the GetRoleCredentials operation: Session token not found or invalid."
   Example output:

   {    "roleCredentials": {
           "accessKeyId": "ASIA*************",
           "secretAccessKey": "**********************************",
           "sessionToken": "****************************************",
           "expiration": 1592362463000
       }
   }

4. Configure the credentials as environment variables.

Related information

How do I use IAM Identity Center permission sets?