title: AWS CLI - how to generate security tokens for a cognito user
body: <p>Ultimately, I need to generate a AccessKeyId, SecirutyKey and SessionToken for a user in a Cognito User Pool so I can test a lambda function as a cognito user using Postman. So far, I've spent 2 days trying to figure this out. It seems that this would work:</p>
  
  <pre><code>aws sts assume-role-with-web-identity --role-arn arn:aws:iam::1234567890:role/rolename--role-session-name "RoleSession1" --web-identity-token ??? --provider-id provideridvalue
  </code></pre>
  
  <p>I was able to get the provider-id value but I'm having trouble getting a valid value for the web-identity-token. </p>
  
  <p>If I understand correctly this should get me the web-identity-token:</p>
  
  <pre><code>aws cognito-idp initiate-auth --auth-flow USER_PASSWORD_AUTH --client-id clientidvalue --auth-parameters USERNAME=usernamevalue,PASSWORD=passwordvalue
  </code></pre>
  
  <p>I obtained the clientidvalue from the Federated Identities pool.</p>
  
  <p>The problem I have been unable to resolve is that the above command gives me this error:</p>
  
  <blockquote>
    <p>Unknown options: PASSWORD=&lt;password></p>
  </blockquote>
  
  <p>I've tried many different variations including json format but nothing works. What am I doing wrong?</p>