Skip to content

Instantly share code, notes, and snippets.

@ottokruse

ottokruse/main.py

Created March 25, 2022 16:17
Show Gist options
  • Save ottokruse/2ce7a4ce840e623cd6ad768be3f0afe9 to your computer and use it in GitHub Desktop.
Save ottokruse/2ce7a4ce840e623cd6ad768be3f0afe9 to your computer and use it in GitHub Desktop.
Download ZIP
Trade a Cognito User Pool JWT for AWS credentials with a Cognito Identity Pool
Raw
main.py
import boto3
session = boto3.Session()
cognito_client = session.client("cognito-identity")
id_token = "<jwt>"
identity_response = cognito_client.get_id(
IdentityPoolId="<identity pool id>",
Logins={"cognito-idp.<region>.amazonaws.com/<user pool id>": id_token}, # Only need to provide this here as well, if the Identity Pool doesn't allow unauthenticated identities
)
credentials_response = cognito_client.get_credentials_for_identity(
IdentityId=identity_response["IdentityId"],
Logins={"cognito-idp.eu-west-1.amazonaws.com/<user pool id>": id_token},
)
print(f"export AWS_ACCESS_KEY_ID={credentials_response['Credentials']['AccessKeyId']}")
print(f"export AWS_SECRET_ACCESS_KEY={credentials_response['Credentials']['SecretKey']}")
print(f"export AWS_SESSION_TOKEN={credentials_response['Credentials']['SessionToken']}")
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment