Secure Token Service application programming interfaces
The Ceph Object Gateway implements the AssumeRole and AssumeRoleWithWebIdentity Secure Token Service (STS) application programming interfaces (APIs).
AssumeRole
This API returns a set of temporary credentials for cross-account access. These temporary
credentials allow for both, permission policies attached with Role and policies attached with
AssumeRole API. The RoleArn and the RoleSessionName request
parameters are required, but the other request parameters are optional.
RoleArn
- Description
-
The role to assume for the Amazon Resource Name (ARN) with a length of 20 to 2048 characters.
- Type
-
String
- Required
-
Yes
RoleSessionName
- Description
-
Identifying the role session name to assume. The role session name can uniquely identify a session when different principals or different reasons assume a role. This parameter’s value has a length of 2 to 64 characters. The
=,,,.,@, and-characters are allowed, but no spaces allowed. - Type
-
String
- Required
-
Yes
Policy
- Description
-
An identity and access management policy (IAM) in a JSON format for use in an inline session. This parameter’s value has a length of 1 to 2048 characters.
- Type
-
String
- Required
-
No
DurationSeconds
- Description
-
The duration of the session in seconds, with a minimum value of
900seconds to a maximum value of43200seconds. The default value is3600seconds. - Type
-
Integer
- Required
-
No
ExternalId
- Description
-
When assuming a role for another account, provide the unique external identifier if available. This parameter’s value has a length of 2 to 1224 characters.
- Type
-
String
- Required
-
No
SerialNumber
- Description
-
A user’s identification number from their associated multi-factor authentication (MFA) device. The parameter’s value can be the serial number of a hardware device or a virtual device, with a length of 9 to 256 characters.
- Type
-
String
- Required
-
No
TokenCode
- Description
-
The value generated from the multi-factor authentication (MFA) device, if the trust policy requires MFA. If an MFA device is required, and if this parameter’s value is empty or expired, then AssumeRole call returns an "access denied" error message. This parameter’s value has a fixed length of 6 characters.
- Type
-
String
- Required
-
No
AssumeRoleWithWebIdentity
This API returns a set of temporary credentials for users who have been authenticated by an
application, such as OpenID Connect or OAuth 2.0 Identity Provider. The RoleArn and
the RoleSessionName request parameters are required, but the other request
parameters are optional.
RoleArn
- Description
-
The role to assume for the Amazon Resource Name (ARN) with a length of 20 to 2048 characters.
- Type
-
String
- Required
-
Yes
RoleSessionName
- Description
-
Identifying the role session name to assume. The role session name can uniquely identify a session when different principals or different reasons assume a role. This parameter’s value has a length of 2 to 64 characters. The
=,,,.,@, and-characters are allowed, but no spaces are allowed. - Type
-
String
- Required
-
Yes
Policy
- Description
-
An identity and access management policy (IAM) in a JSON format for use in an inline session. This parameter’s value has a length of 1 to 2048 characters.
- Type
-
String
- Required
-
No
DurationSeconds
- Description
-
The duration of the session in seconds, with a minimum value of
900seconds to a maximum value of43200seconds. The default value is3600seconds. - Type
-
Integer
- Required
-
No
ProviderId
- Description
-
The fully qualified host component of the domain name from the identity provider. This parameter’s value is only valid for OAuth 2.0 access tokens, with a length of 4 to 2048 characters.
- Type
-
String
- Required
-
No
WebIdentityToken
- Description
-
The OpenID Connect identity token or OAuth 2.0 access token provided from an identity provider. This parameter’s value has a length of 4 to 2048 characters.
- Type
-
String
- Required
-
No
Reference
For more information, see Examples using the Secure Token Service APIs.