Trade a Cognito User Pool JWT for AWS credentials with a Cognito Identity Pool

main.py

import boto3

session = boto3.Session()
cognito_client = session.client("cognito-identity")

id_token = "<jwt>"

identity_response = cognito_client.get_id(
    IdentityPoolId="<identity pool id>",
    Logins={"cognito-idp.<region>.amazonaws.com/<user pool id>": id_token}, # Only need to provide this here as well, if the Identity Pool doesn't allow unauthenticated identities
)
credentials_response = cognito_client.get_credentials_for_identity(
    IdentityId=identity_response["IdentityId"],
    Logins={"cognito-idp.eu-west-1.amazonaws.com/<user pool id>": id_token},
)

print(f"export AWS_ACCESS_KEY_ID={credentials_response['Credentials']['AccessKeyId']}")
print(f"export AWS_SECRET_ACCESS_KEY={credentials_response['Credentials']['SecretKey']}")
print(f"export AWS_SESSION_TOKEN={credentials_response['Credentials']['SessionToken']}")