How to Deploy to AWS With an Assumed Role in Jenkins

pipeline {
  agent any
  stages {
    stage('Deploy') {
      steps {
        withCredentials([usernamePassword(credentialsId: 'aws-base',
            usernameVariable: 'AWS_ACCESS_KEY_ID',
            passwordVariable: 'AWS_SECRET_ACCESS_KEY')]) {
          sh '''
            CREDS=$(aws sts assume-role \
              --role-arn arn:aws:iam::123456789012:role/deployer \
              --role-session-name jenkins-$BUILD_NUMBER \
              --query 'Credentials' --output json)
            export AWS_ACCESS_KEY_ID=$(echo "$CREDS" | jq -r .AccessKeyId)
            export AWS_SECRET_ACCESS_KEY=$(echo "$CREDS" | jq -r .SecretAccessKey)
            export AWS_SESSION_TOKEN=$(echo "$CREDS" | jq -r .SessionToken)
            aws lambda update-function-code --function-name api --zip-file fileb://build.zip
          '''
        }
      }
    }
  }
}