diff --git a/lib/dpl/providers/elasticbeanstalk.rb b/lib/dpl/providers/elasticbeanstalk.rb
index fcef9df94..f18312b81 100644
--- a/lib/dpl/providers/elasticbeanstalk.rb
+++ b/lib/dpl/providers/elasticbeanstalk.rb
@@ -30,6 +30,7 @@ class Elasticbeanstalk < Provider
 
       opt '--access_key_id ID', 'AWS Access Key ID', required: true, secret: true
       opt '--secret_access_key KEY', 'AWS Secret Key', required: true, secret: true
+      opt '--session_token TOKEN', 'AWS Session Token', required: false, secret: true
       opt '--region REGION', 'AWS Region the Elastic Beanstalk app is running in', default: 'us-east-1'
       opt '--app NAME', 'Elastic Beanstalk application name', default: :repo_name
       opt '--env NAME', 'Elastic Beanstalk environment name to be updated.'
@@ -43,6 +44,7 @@ class Elasticbeanstalk < Provider
       opt '--debug', internal: true
 
       msgs login: 'Using Access Key: %{access_key_id}',
+           login_token: 'Using Access Key: %{access_key_id}, Session Token: %{session_token}',
            zip_add: 'Adding %s'
 
       msgs clean_description: 'Removed non-printable characters from the version description'
@@ -50,7 +52,7 @@ class Elasticbeanstalk < Provider
       attr_reader :started, :object, :version
 
       def login
-        info :login
+        info(session_token ? :login_token : :login)
       end
 
       def setup
@@ -173,7 +175,7 @@ def environment
       end
 
       def credentials
-        Aws::Credentials.new(access_key_id, secret_access_key)
+        Aws::Credentials.new(access_key_id, secret_access_key, session_token)
       end
 
       def s3
diff --git a/spec/dpl/providers/elasticbeanstalk_spec.rb b/spec/dpl/providers/elasticbeanstalk_spec.rb
index 6acff2784..cd596d6d7 100644
--- a/spec/dpl/providers/elasticbeanstalk_spec.rb
+++ b/spec/dpl/providers/elasticbeanstalk_spec.rb
@@ -134,6 +134,20 @@
     it { is_expected.to have_run '[info] Using Access Key: ac******************' }
   end
 
+  describe 'with ~/.aws/credentials', run: false do
+    let(:args) { |e| %w(--env env --bucket_name bucket) }
+
+    file '~/.aws/credentials', <<-str.sub(/^\s*/, '')
+      [default]
+      aws_access_key_id=access_key_id
+      aws_secret_access_key=secret_access_key
+      aws_session_token=token
+    str
+
+    before { subject.run }
+    it { should have_run '[info] Using Access Key: ac******************, Session Token: t*******************' }
+  end
+
   describe 'with ~/.aws/config', run: false do
     let(:args) { |_e| %w[--access_key_id id --secret_access_key secret] }