How do I use the AWS CLI to get temporary credentials for an IAM Identity Center user?

Short description

When you configure a named profile to use IAM Identity Center, a JSON file in the $ cd ~/.aws/sso/cache directory is created. The JSON file contains a JSON Web Token (JWT) that's used to get the temporary security credentials with the get-role-credentials API-equivalent command. The access token is valid for 8 hours. You can see the expiration time in the expiresAt timestamp in the JSON file. You must use the get-role-credentials command to reauthenticate expired tokens.

Resolution

Use the AWS Command Line Interface (AWS CLI) to get the temporary credentials for an IAM Identity Center user.

Note: If you receive errors when you run AWS CLI commands, then see Troubleshoot AWS CLI errors. Also, make sure that you're using the most recent AWS CLI version.

Get the temporary credentials

In the AWS CLI, complete the following steps:

1. Open the JSON file, and then copy the access token:

   $ cat 535a8450b05870c9045c8a7b95870.json
   {"startUrl": "https://my-sso-portal.awsapps.com/start", "region": "us-east-1", "accessToken": "eyJlbmMiOiJBM….", "expiresAt": "2020-06-17T10:02:08UTC"}

2. Run the get-role-credentials AWS CLI command to get the credentials for the IAM Identity Center user:

   $ aws sso get-role-credentials --account-id 123456789012 --role-name permission-set-name --access-token eyJlbmMiOiJBM…. --region enter_the_same_sso_region_same_in_the_JSON_file

   Example output:

   {    "roleCredentials": {
           "accessKeyId": "ASIA*************",
           "secretAccessKey": "**********************************",
           "sessionToken": "****************************************",
           "expiration": 1592362463000
       }
   }

3. Configure the credentials as environment variables.

Troubleshoot error messages

"An error occurred (ForbiddenException) when calling the GetRoleCredentials operation: No access."

This error might occur because of an incorrect role name in the AWS CLI. Check the role name to confirm that it's correct.

"An error occurred (UnauthorizedException) when calling the GetRoleCredentials operation: Session token not found or invalid."

This error occurs because the session token or AWS Region is incorrect. Make sure that the Region in the AWS CLI command is the same as the Region in the JSON file output.

Related information

How do I use IAM Identity Center permission sets?