> ## Documentation Index
> Fetch the complete documentation index at: https://namespace.so/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# nsc auth exchange-aws-cognito-token

Generate a Namespace token from an AWS Cognito JWT.

`nsc auth exchange-aws-cognito-token` exchanges credentials from an AWS Cognito identity pool for a Namespace-scoped token. This lets an AWS-based workload (or a developer testing locally with an AWS profile) authenticate to Namespace using short-lived AWS credentials instead of a long-lived Namespace token.

This is the CLI-side counterpart to `nsc auth trust-aws-cognito-identity-pool` — a Namespace workspace must already trust the identity pool before an exchange can succeed. See [Workload Federation with AWS](/docs/federation/aws) for the full setup flow, from creating the Cognito identity pool through establishing the trust relationship.

## Usage

```bash theme={null}
nsc auth exchange-aws-cognito-token [--aws_profile string] [--aws_region string] [--ensure duration] [--identity_pool string] [--tenant_id string]
```

### Example

```bash theme={null}
nsc auth exchange-aws-cognito-token \
  --aws_region <region> \
  --identity_pool <guid> \
  --tenant_id <workspace-id>
```

## Options

<h3 id="--aws_profile-string">
  \--aws\_profile string
</h3>

Use the specified AWS profile. This selects which set of credentials from your local AWS configuration (e.g. `~/.aws/credentials`) to use when authenticating against the Cognito identity pool. Useful when testing the federation flow locally, where the AWS credentials aren't already implied by the environment (e.g. instance metadata).

<h3 id="--aws_region-string">
  \--aws\_region string
</h3>

The AWS region to connect to. This should be the region where the Cognito identity pool you're exchanging against was created.

<h3 id="--ensure-duration">
  \--ensure duration
</h3>

If the current token is still valid for this duration, do nothing. Otherwise fetch a new token. Defaults to `0s`, which always fetches a fresh token. Setting this to a non-zero duration makes the command safe to call repeatedly (e.g. from a script or a shell hook) without unconditionally minting a new token on every invocation.

<h3 id="--identity_pool-string">
  \--identity\_pool string
</h3>

UUID of the identity pool. This identifies the specific AWS Cognito identity pool to exchange credentials against, within the region given by `--aws_region`.

<h3 id="--tenant_id-string">
  \--tenant\_id string
</h3>

What tenant to authenticate. Use this to target a specific Namespace tenant when your account has access to more than one and the token exchange would otherwise be ambiguous.

## Related Topics

* [Workload Federation with AWS](/docs/federation/aws) - Set up Cognito-based federation end to end
* [Workload Federation](/docs/federation) - Federation with other cloud providers and identity systems