pub async fn assume_role_with_web_identity(
        &self,
    ) -> Result<AwsCredentials, RusotoError<AssumeRoleWithWebIdentityError>> {
        let request = AssumeRoleWithWebIdentityRequest {
            web_identity_token: self.wif_token.clone(),
            provider_id: self.wif_provider.clone(),
            role_arn: self.role_arn.clone(),
            role_session_name: self.session_name.clone(),
            duration_seconds: Some(self.session_duration.num_seconds() as i64),
            policy: self.scope_down_policy.clone(),
            ..Default::default()
        };

        let resp = self
            .sts_client
            .assume_role_with_web_identity(request)
            .await?;

        let creds = resp
            .credentials
            .ok_or(CredentialsError::new("no credentials in response"))?;

        let mut aws_creds = AwsCredentials::new_for_credentials(creds)?;

        if let Some(subject_from_wif) = resp.subject_from_web_identity_token {
            aws_creds.claims_mut().insert(
                rusoto_core::credential::claims::SUBJECT.to_owned(),
                subject_from_wif,
            );
        }

        if let Some(audience) = resp.audience {
            aws_creds.claims_mut().insert(
                rusoto_core::credential::claims::AUDIENCE.to_owned(),
                audience,
            );
        }

        if let Some(issuer) = resp.provider {
            aws_creds
                .claims_mut()
                .insert(rusoto_core::credential::claims::ISSUER.to_owned(), issuer);
        }

        Ok(aws_creds)
    }
Calls `AssumeRoleWithWebIdentity` to get a session token from the STS Api.
rusoto/services/sts/src/custom/credential.rs