Assume a role with open id connect

jwt_maker.py

from jose import jwt
import datetime
import boto3
​
# private key
key = {
      "p": "snip"
}
​
# create a JWT token that will be accepted by the role trust policy
payload = {
      "aud": [
        "sts.amazonaws.com"
      ],
    'iss': "https://russ-public.s3.amazonaws.com/projects/identity-application/",
    'iat': datetime.datetime.now().strftime("%s"),
    'exp': int(datetime.datetime.now().strftime("%s")) + 60,
    'sub': 'subject'
}
token = jwt.encode(payload , key, algorithm='RS256', headers={'kid': key["kid"]})
​
print("=" * 30)
print(token)
print("=" * 30)
​
sts = boto3.client("sts")
​
# use the token to get short lived credentials for the role
creds = sts.assume_role_with_web_identity(
    # RoleArn='arn:aws:iam::snip:role/open-id-russ-test',
    RoleArn='arn:aws:iam::snip:role/open-id-identity-application',
    RoleSessionName='session1',
    WebIdentityToken=token
)
​