Issue

Old school boto expects a session token to be stored as a value of aws_security_token in ~/.aws/credentials
Boto3 stores the same value in aws_session_token in ~/.aws/credentials

If you run aws configure set aws_session_token ${VALUE} the aws cli will correctly place the value in ~/.aws/credentials

Running aws configure set aws_security_token ${VALUE} the aws_security_token value ends up in a users ~/.aws/config instead of ~/.aws/credentials.

So for those of us who still have legacy boto code hanging around, that means we are required to manually munge the ~/.aws/credentials file to properly inject the aws_security_token.

Solution

Provide backward compatibility by writing aws_security_token to the credentials file.

Related issues

boto/boto#2988
#1197