Jenkins master creates an API key, and publishes it to SSM parameter store.

nmg-jenkins-api-key.sh

#!/bin/bash

if [ ! -f "/var/lib/jenkins/api_key.txt" ]; then
    CRUMB=$(curl -s http://localhost:8080/crumbIssuer/api/json --user admin:${admin_password} | jq -r .crumb)
    API_KEY=$(curl -s -X POST http://localhost:8080/me/descriptorByName/jenkins.security.ApiTokenProperty/generateNewToken --user admin:${admin_password} --data newTokenName=agent-token -H "Jenkins-Crumb: $CRUMB" | jq -r .data.tokenValue)
    echo $API_KEY > /var/lib/jenkins/api_key.txt
fi

aws ssm put-parameter --name "${api_ssm_parameter}" --value "$(cat /var/lib/jenkins/api_key.txt)" --type "SecureString" --overwrite --region ${aws_region}

sed -i -e "s@APIKEY@$(cat /var/lib/jenkins/api_key.txt)@" /opt/cloudwatch-busy-executors.sh
sed -i -e "s@APIKEY@$(cat /var/lib/jenkins/api_key.txt)@" /opt/cloudwatch-idle-executors.sh