Enable reading cli-input-json from stdin

[apanys]

Is your feature request related to a problem? Please describe.
I want to use aws-cli in a pipeline scenario. Therefore I want to pass as argument for --cli-input-json the value from stdin.

Describe the solution you'd like
The character - should serve as indicator, that the value for --cli-input-json should be read from stdin.

cat sample.json | aws secretsmanager create-secret --cli-input-json -

Describe alternatives you've considered
No workaround available as far as I know.

Additional context

[stobrien89]

Hi @apanys,

Thank you for the feature request! I'm going to link a related pull request and a related feature request #3700.

[Nanovox]

Another Use Case

We would love to see AWS CLI interact with stdin as well. For our case, we'd like to pipe a value from a file or other program to be stored in a Parameter Store key.

As an example: aws ssm put-parameter ... < cat /path/to/key_value.txt

Justification: Sensative information, particularly with Secure String values, can be exposed in proc tables when the parameter store key value is passed to the CLI as a command line argument.

[tavin]

I doubt we're going to see AWS fix this, but here's a workaround:

your_secret_output | aws ssm put-parameter ... --value file:///dev/stdin

The file:///dev/stdin trick won't work for --cli-input-json but it does work for --value.

[pypp]

you can also use xargs like so:

your_secret_output | xargs -0 aws ssm put-parameter ... --cli-input-json

make sure --cli-input-json is the last argument

[SebTardif]

Analysis & Implementation Proposal

I have done a thorough analysis of this issue and all related references (#3700, PR #3209, #7850) and reviewed the current source code on the v2 branch.

Root Cause

--cli-input-json (and --cli-input-yaml) do not support reading from stdin because CliInputArgument._get_arg_value() in awscli/customizations/cliinput.py only resolves values via get_paramfile() (which only handles file:// and fileb:// prefixes) or treats the value as inline JSON. There is no convention for - meaning "read from stdin".

Proposed Solution

Following the direction suggested by @stealthycoin in PR #3209 — add - support specifically in CliInputArgument._get_arg_value(), matching the existing aws s3 cp - convention:

# In CliInputArgument._get_arg_value():
if arg_value == '-':
    return sys.stdin.read()

This approach:

• Follows the existing s3 cp - convention already established in the CLI
• Is scoped only to --cli-input-json / --cli-input-yaml (avoids interactive mode conflicts raised in PR added support for using stdin and pipes #3209)
• Reads stdin exactly once (avoids the double-read problem that plagued file:///dev/stdin)
• Works cross-platform (no /dev/stdin dependency)
• Does NOT add a generic pipe:// or stdin:// scheme (which was rejected by the team)

Usage:

cat sample.json | aws secretsmanager create-secret --cli-input-json -
echo '{"name":"secret"}' | aws secretsmanager create-secret --cli-input-json -
generate_json | aws ecs register-task-definition --cli-input-json -

Security Use Case (from @Nanovox)

This also addresses the security concern about sensitive values being exposed in proc tables — stdin-based input avoids command-line argument exposure.

Current Workarounds

For anyone who needs this today:

1. Command substitution: aws cmd --cli-input-json "$(cat file.json)"
2. xargs: cat file.json | xargs -0 aws cmd --cli-input-json (must be last arg)
3. For individual params (not --cli-input-json): --value file:///dev/stdin works on Linux/macOS

PR

I am opening a PR with this implementation shortly — will link it here.

Note: This also applies to --cli-input-yaml and tracks with #7850.