I am not able to add session_token variable in aws connection feature of VSTS . Please help about aws-toolkit-azure-devops

[stevejroberts]

We'll take a look to see if we can repro. What fields did you fill out in the credential dialog? (Don't list the values here, just the names of the fields you populated).

[akkipuneet]

Thanks for the reply Steve . Please find above snapshot to see my aws connection configuration in my task . I tried configuring the aws connection with AWS CLI task but getting below error

2017-12-08T13:41:49.8300771Z ##[section]Starting: AWS CLI: s3
2017-12-08T13:41:49.8300771Z ==============================================================================
2017-12-08T13:41:49.8300771Z Task : AWS CLI
2017-12-08T13:41:49.8300771Z Description : Run an AWS CLI command
2017-12-08T13:41:49.8300771Z Version : 1.0.14
2017-12-08T13:41:49.8300771Z Author : Amazon Web Services
2017-12-08T13:41:49.8300771Z Help : The AWS Command Line Interface (CLI) is a unified tool to manage your AWS services. With just one tool to download and configure, you can control multiple AWS services from the command line and automate them through scripts. You must have the AWS CLI installed to use this task. See http://docs.aws.amazon.com/cli/latest/userguide/installing.html for more details.
2017-12-08T13:41:49.8300771Z ==============================================================================
2017-12-08T13:41:50.1113236Z 4b091740-92a4-44e7-99e7-ce1a7ab67bd5 exists true
2017-12-08T13:41:50.1113236Z Configuring task to use role-based credentials.
2017-12-08T13:41:50.5644336Z ##[error]The security token included in the request is invalid.
2017-12-08T13:41:50.5644336Z ##[section]Finishing: AWS CLI: s3

---

Dont know where to give aws_session_token value .
FYI , My access keys are valid for one hour .

[stevejroberts]

Just so I'm clear, you're trying to use existing temporary session credentials to then assume a role? If that's the case, the tools don't support that currently.

The access and secret key should not be temporary (since we don't know when tasks using the credentials will run, having time-limited credentials specified would be problematic). Instead, you should specify the access and secret key for an IAM user (or you could use your root credentials, but we really don't advise that). Add in the arn of the role you want the task(s) to run under when those credentials are used and the tools will automatically generate time-limited credentials, scoped to the role, when needed. You don't need to handle the session token etc.

[stevejroberts]

Resolving issue as I don't think there are any changes to be done here, as explained above. If there is a usage scenario where keys plus an externally-generated session token is needed and for which the tool's current use of assume role wouldn't suit, feel free to reopen and we can discuss further.