---
title: Set up AWS session tokens
source: https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/set-up-aws-credentials/session-tokens-setup
---

Session tokens provide temporary credentials with automatic expiration.

## Use cases

-   Local development and testing
-   CI/CD pipelines requiring credential rotation
-   Environments with compliance requirements for time-limited access (typically 1-12 hours)

## Prerequisites

Before generating session tokens, ensure you have:

-   [AWS CLI installed and configured](https://aws.amazon.com/cli/)
-   An existing IAM role you can assume
-   Your [New Relic account ID](https://docs.newrelic.com/docs/accounts/accounts-billing/account-structure/account-id)

## Generate temporary credentials

1.  Open your terminal and run this command (replace with your role ARN):

    ```bash
    aws sts assume-role \
        --role-arn "arn:aws:iam::YOUR_ACCOUNT:role/YOUR_ROLE" \
        --role-session-name "WorkflowAutomationSession"
    ```

    If this is your first time using AWS CLI, you may need to configure it with `aws configure` and enter your access credentials:

    ![Image of the Static Access credentials](https://docs.newrelic.com/images/static-access.webp "Image of the Static Access credentials")

2.  AWS returns three values—you need all three:

    ```json
    {
      "Credentials": {
          "AccessKeyId": "ASIAIOSFODNN7EXAMPLE",
          "SecretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
          "SessionToken": "FQoGZXIvYXdzEBk...",
          "Expiration": "2025-01-25T12:00:00Z"
      }
    }
    ```

3.  Store all three credentials in [secrets manager](https://docs.newrelic.com/docs/workflow-automation/limitations-and-faq/workflow-best-practices#secure-credentials):

-   `AccessKeyId` store as `awsAccessKeyId`
-   `SecretAccessKey` store as `awsSecretAccessKey`
-   `SessionToken` store as `awsSessionToken`

    > #### ⚠️ CAUTION
    >
    > Session tokens expire (typically after 1 hour). Set a reminder to refresh them before the `Expiration` timestamp, or your workflows will fail with authentication errors.

## Related topics [#related-topics]

[AWS credentials overview](https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/set-up-aws-credentials)

Compare authentication methods and choose the right one

[AWS policy examples](https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/set-up-aws-credentials/policy-examples)

Complete IAM policies for EC2, SQS, DynamoDB, and more

[AWS actions](https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/actions-catalog/actions-catalog)

Browse EC2, Lambda, S3, SQS, and other AWS actions

[Workflow best practices](https://docs.newrelic.com/docs/workflow-automation/limitations-and-faq/workflow-best-practices)

Security best practices for credentials and secrets