logo

nsc auth exchange-aws-cognito-token

Generate a Namespace token from an AWS Cognito JWT.

nsc auth exchange-aws-cognito-token exchanges credentials from an AWS Cognito identity pool for a Namespace-scoped token. This lets an AWS-based workload (or a developer testing locally with an AWS profile) authenticate to Namespace using short-lived AWS credentials instead of a long-lived Namespace token.

This is the CLI-side counterpart to nsc auth trust-aws-cognito-identity-pool — a Namespace workspace must already trust the identity pool before an exchange can succeed. See Workload Federation with AWS for the full setup flow, from creating the Cognito identity pool through establishing the trust relationship.

Usage

nsc auth exchange-aws-cognito-token [--aws_profile string] [--aws_region string] [--ensure duration] [--identity_pool string] [--tenant_id string]

Example

$ nsc auth exchange-aws-cognito-token \
    --aws_region <region> \
    --identity_pool <guid> \
    --tenant_id <workspace-id>

Options

--aws_profile string

Use the specified AWS profile. This selects which set of credentials from your local AWS configuration (e.g. ~/.aws/credentials) to use when authenticating against the Cognito identity pool. Useful when testing the federation flow locally, where the AWS credentials aren't already implied by the environment (e.g. instance metadata).

--aws_region string

The AWS region to connect to. This should be the region where the Cognito identity pool you're exchanging against was created.

--ensure duration

If the current token is still valid for this duration, do nothing. Otherwise fetch a new token. Defaults to 0s, which always fetches a fresh token. Setting this to a non-zero duration makes the command safe to call repeatedly (e.g. from a script or a shell hook) without unconditionally minting a new token on every invocation.

--identity_pool string

UUID of the identity pool. This identifies the specific AWS Cognito identity pool to exchange credentials against, within the region given by --aws_region.

--tenant_id string

What tenant to authenticate. Use this to target a specific Namespace tenant when your account has access to more than one and the token exchange would otherwise be ambiguous.