如何在~/.aws/credentials中设置aws_security_token适配容器默认配置？

问题背景 #

执行Docker容器前需要切换AWS角色，容器仅使用[default]配置文件。只能通过挂载~/.aws/credentials文件传递凭证，无法使用环境变量。编写自动化脚本时，发现aws configure set aws_security_token会将该字段写入~/.aws/config而非~/.aws/credentials，导致容器内命令因无法读取有效安全令牌而失败。

当前脚本草稿 #

profile=${1:-MicroservicesInternal-Learning-Engineer}
myrole_credentials=$(aws sts assume-role --role-arn arn:aws:iam::123456789123:role/my-role --role-session-name myname --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" --output text --profile $profile)

aws_access_key_id=$(echo $myrole_credentials | cut -d" " -f1)
aws_secret_access_key=$(echo $myrole_credentials | cut -d" " -f2)
aws_session_token=$(echo $myrole_credentials | cut -d" " -f3)
aws_security_token=$(echo $myrole_credentials | cut -d" " -f3)

echo aws_access_key_id=$aws_access_key_id
echo aws_secret_access_key=$aws_secret_access_key
echo aws_session_token=$aws_session_token
echo aws_security_token=$aws_security_token

aws configure set aws_access_key_id $aws_access_key_id --profile default
aws configure set aws_secret_access_key $aws_secret_access_key --profile default
aws configure set aws_session_token $aws_session_token --profile default
aws configure set aws_security_token $aws_security_token --profile default

aws sts get-caller-identity

示例错误输出 #

aws_access_key_id=key1234
aws_secret_access_key=secret1234
aws_session_token=token1234
aws_security_token=token1234

An error occurred (ExpiredToken) when calling the GetCallerIdentity operation: The security token included in the request is expired

解决方案 #

aws configure set命令会根据参数类型自动选择写入credentials或config文件，其中aws_security_token默认被归类为配置项，会写入config文件。要将其写入credentials文件，直接编辑文件是最可靠的方式：

替换脚本中所有aws configure set的行，改为直接覆盖~/.aws/credentials的[default]段：

# 替换原有的aws configure set命令
cat > ~/.aws/credentials << EOF
[default]
aws_access_key_id = $aws_access_key_id
aws_secret_access_key = $aws_secret_access_key
aws_session_token = $aws_session_token
aws_security_token = $aws_security_token
EOF

说明 #

• 这种方式确保所有凭证字段都写入~/.aws/credentials的[default]配置段，容器挂载该文件后可直接读取到完整有效的凭证。
• aws_session_token和aws_security_token值相同，部分旧版AWS工具依赖aws_security_token字段，同时写入两个字段可兼容更多场景。

内容的提问来源于stack exchange，提问作者Chip