title: bash script for AWS assume-role
body: <p>I am trying to assume an AWS role within a CI/CD pipeline, hence I have to write a script to change the role via a script. Below is the script to do that, and I used <code>source &lt;script&gt;.sh</code> to replace the existing AWS access &amp; secret keys, and add the session key.</p>
  <p>I checked that the 3 env variables are there by echoing them in the terminal.</p>
  <pre><code>#!/bin/bash
  
  output=&quot;/tmp/assume-role-output.json&quot;
  
  aws sts assume-role --role-arn &quot;arn:aws:iam::&lt;account-id&gt;:role/&lt;rolename&gt;&quot; --role-session-name AWSCLI-Session &gt; $output
  AccessKeyId=$(cat $output | jq '.Credentials''.AccessKeyId')
  SecretAccessKey=$(cat $output | jq '.Credentials''.SecretAccessKey')
  SessionToken=$(cat $output | jq '.Credentials''.SessionToken')
  
  export AWS_ACCESS_KEY_ID=$AccessKeyId
  export AWS_SECRET_ACCESS_KEY=$SecretAccessKey
  export AWS_SESSION_TOKEN=$SessionToken
  </code></pre>
  <p>However, when I tried running a simple aws command to list ECR images <code>aws ecr list-images --registry-id &lt;id&gt; --repository-name &lt;name&gt;</code>, it gave the following error message.</p>
  <pre><code>An error occurred (UnrecognizedClientException) when calling the ListImages operation: 
  The security token included in the request is invalid.
  </code></pre>
  <p>I tried manually setting the AWS keys and token in the terminal, and surprisingly the ecr list command works.</p>
  <pre><code>export AWS_ACCESS_KEY_ID=&quot;XXX&quot;
  export AWS_SECRET_ACCESS_KEY=&quot;XXX&quot;
  export AWS_SESSION_TOKEN=&quot;XXX&quot;
  </code></pre>
  <p>Does anyone know what is wrong with my script?</p>