Basic example script to test if IAM/STS assume role with web identity is working

gistfile1.txt

#!/bin/bash
export AWS_CA_BUNDLE="/etc/pki/ca-trust/source/anchors/cert.pem"
unset AWS_ACCESS_KEY_ID
unset AWS_SECRET_ACCESS_KEY
unset AWS_SESSION_TOKEN
echo "Getting the JWT from SSO..."
KC_ACCESS_TOKEN="$(./get_web_token.sh $1 $2 | jq -r '.id_token')"
if [ $? != 0 ] ; then echo "Failed to get token from SSO" ; exit 1  ; fi
echo -e "\n"

echo "Triying to Assume Role $3 using provided JWT token.."
echo -e "\n"
IDM_ASSUME_ROLE_CREDS=$(aws sts assume-role-with-web-identity --role-arn "arn:aws:iam:::role/$3" --role-session-name testbr --endpoint=https://ibmstoragecephrgw.example.local:8443 --web-identity-token="$KC_ACCESS_TOKEN")

echo "Export AWS ENV variables to use the AWS CLI with the STS creds.. "
export AWS_ACCESS_KEY_ID=$(echo $IDM_ASSUME_ROLE_CREDS | jq -r .Credentials.AccessKeyId)
export AWS_SECRET_ACCESS_KEY=$(echo $IDM_ASSUME_ROLE_CREDS | jq -r .Credentials.SecretAccessKey)
export AWS_SESSION_TOKEN=$(echo $IDM_ASSUME_ROLE_CREDS | jq -r .Credentials.SessionToken)
export AWS_ENDPOINT_URL=https://ibmstoragecephrgw.example.local:8443
echo -e "\n"
echo "Also providing the keys to use in the aws credentials file:"
echo "aws_access_key_id = $AWS_ACCESS_KEY_ID"
echo "aws_secret_access_key = $AWS_SECRET_ACCESS_KEY"
echo "aws_session_token = $AWS_SESSION_TOKEN"