obtain an access token of AWS Cognito

createUser.sh

#!/bin/bash

USER_POOL_ID=<user pool ID>
CLIENT_ID=<application client ID>
CLIENT_SECRET=<client secret>
COGNITO_USERNAME=<any user name>
COGNITO_TEMP_PASSWORD=<temporary password>
COGNITO_PASSWORD=<any user password>

SECRET_HASH=$(echo -n "${COGNITO_USERNAME}${CLIENT_ID}" | openssl dgst -sha256 -hmac "${CLIENT_SECRET}" -binary | base64)

aws cognito-idp admin-create-user \
    --user-pool-id ${USER_POOL_ID} \
    --username ${COGNITO_USERNAME} \
    --user-attributes Name=email,Value="foo@example.com" Name=email_verified,Value=true \
    --message-action SUPPRESS

aws cognito-idp admin-set-user-password \
    --user-pool-id ${USER_POOL_ID} \
    --username ${COGNITO_USERNAME} \
    --password ${COGNITO_TEMP_PASSWORD}

SESSION_ID=$(aws cognito-idp admin-initiate-auth \
    --user-pool-id="${USER_POOL_ID}" \
    --client-id="${CLIENT_ID}" \
    --auth-flow="ADMIN_USER_PASSWORD_AUTH" \
    --auth-parameters="USERNAME=${COGNITO_USERNAME},PASSWORD=${COGNITO_TEMP_PASSWORD},SECRET_HASH=${SECRET_HASH}" \
    | jq -r .Session)

aws cognito-idp admin-respond-to-auth-challenge \
    --user-pool-id="${USER_POOL_ID}" \
    --client-id="${CLIENT_ID}" \
    --challenge-name="NEW_PASSWORD_REQUIRED" \
    --challenge-responses="USERNAME=${COGNITO_USERNAME},NEW_PASSWORD=${COGNITO_PASSWORD},SECRET_HASH=${SECRET_HASH}" \
    --session ${SESSION_ID} | jq -r .AuthenticationResult.IdToken

getToken.sh

#!/bin/bash

USER_POOL_ID=<user pool ID>
CLIENT_ID=<application client ID>
CLIENT_SECRET=<client secret>
COGNITO_USERNAME=<user name>
COGNITO_PASSWORD=<user password>

SECRET_HASH=$(echo -n "${COGNITO_USERNAME}${CLIENT_ID}" | openssl dgst -sha256 -hmac "${CLIENT_SECRET}" -binary | base64)

aws cognito-idp admin-initiate-auth \
  --user-pool-id ${USER_POOL_ID} \
  --client-id ${CLIENT_ID} \
  --auth-flow "ADMIN_USER_PASSWORD_AUTH" \
  --auth-parameters "USERNAME=${COGNITO_USERNAME},PASSWORD=${COGNITO_PASSWORD},SECRET_HASH=${SECRET_HASH}" \
  | jq -r .AuthenticationResult