From 4948ab24ebf55e81e07d818f50e2e06abe89ce50 Mon Sep 17 00:00:00 2001
From: "Daniel A. Wozniak" <dan.woz@gmail.com>
Date: Mon, 15 Jun 2026 17:38:29 -0700
Subject: [PATCH] Add AWS session token support to salt-cloud EC2 provider

When a ``token`` key is present in the EC2 provider configuration,
forward it as the security token in AWS API calls. Previously only
the ``id`` and ``key`` were used for static credentials.

Fixes #64533
---
 changelog/64533.added.md             |  1 +
 salt/utils/aws.py                    |  6 +++-
 tests/pytests/unit/utils/test_aws.py | 41 ++++++++++++++++++++++++++++
 3 files changed, 47 insertions(+), 1 deletion(-)
 create mode 100644 changelog/64533.added.md

diff --git a/changelog/64533.added.md b/changelog/64533.added.md
new file mode 100644
index 000000000000..dd0e61686595
--- /dev/null
+++ b/changelog/64533.added.md
@@ -0,0 +1 @@
+Add support for AWS session tokens in salt-cloud EC2 provider. When a ``token`` key is present in the provider configuration, it is now forwarded as the security token in AWS API calls.
diff --git a/salt/utils/aws.py b/salt/utils/aws.py
index 086329edafcf..c7d078558c52 100644
--- a/salt/utils/aws.py
+++ b/salt/utils/aws.py
@@ -144,7 +144,11 @@ def creds(provider):
 
         ret_credentials = __AccessKeyId__, __SecretAccessKey__, __Token__
     else:
-        ret_credentials = provider["id"], provider["key"], ""
+        ret_credentials = (
+            provider["id"],
+            provider["key"],
+            provider.get("token") or "",
+        )
 
     if provider.get("role_arn") is not None:
         provider_shadow = provider.copy()
diff --git a/tests/pytests/unit/utils/test_aws.py b/tests/pytests/unit/utils/test_aws.py
index d265c542d43f..d119566e410a 100644
--- a/tests/pytests/unit/utils/test_aws.py
+++ b/tests/pytests/unit/utils/test_aws.py
@@ -208,3 +208,44 @@ def handle_get_metadata_mock(path, **args):
             )
             assert mock_get_metadata.call_count == 0
             assert result == assumed_creds_ret
+
+
+def test_creds_static_with_session_token():
+    """
+    When a provider has static id/key plus a token, creds() must return
+    the token as the third element of the tuple.
+    """
+    provider = {
+        "id": "AKIAIOSFODNN7EXAMPLE",
+        "key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
+        "token": "AQoDYXdzEJr//my-session-token",
+    }
+    result = aws.creds(provider)
+    assert result == (provider["id"], provider["key"], provider["token"])
+
+
+def test_creds_static_without_session_token():
+    """
+    When a provider has static id/key and no token, creds() must return
+    an empty string as the third element for backward compatibility.
+    """
+    provider = {
+        "id": "AKIAIOSFODNN7EXAMPLE",
+        "key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
+    }
+    result = aws.creds(provider)
+    assert result == (provider["id"], provider["key"], "")
+
+
+def test_creds_static_with_none_token():
+    """
+    When a provider has token=None, creds() must return an empty string
+    as the third element (same as no token).
+    """
+    provider = {
+        "id": "AKIAIOSFODNN7EXAMPLE",
+        "key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
+        "token": None,
+    }
+    result = aws.creds(provider)
+    assert result == (provider["id"], provider["key"], "")