code: def auth_ec2(self, pkcs7, nonce=None, role=None, use_token=True, mount_point='aws-ec2'):
          
          params = {'pkcs7': pkcs7}
          if nonce:
              params['nonce'] = nonce
          if role:
              params['role'] = role
  
          return self.login('/v1/auth/{0}/login'.format(mount_point), json=params, use_token=use_token)
docs: POST /auth/<mount point>/login
  
          :param pkcs7: PKCS#7 version of an AWS Instance Identity Document from the EC2 Metadata Service.
          :type pkcs7: str.
          :param nonce: Optional nonce returned as part of the original authentication request. Not required if the backend
              has "allow_instance_migration" or "disallow_reauthentication" options turned on.
          :type nonce: str.
          :param role: Identifier for the AWS auth backend role being requested.
          :type role: str.
          :param use_token: If True, uses the token in the response received from the auth request to set the "token"
              attribute on the current Client class instance.
          :type use_token: bool.
          :param mount_point: The "path" the AWS auth backend was mounted on. Vault currently defaults to "aws". "aws-ec2"
              is the default argument for backwards comparability within this module.
          :type mount_point: str.
          :return: parsed JSON response from the auth POST request
          :rtype: dict.