AWS STS

AWS Security Token Service (STS) é um serviço web que permite solicitar credenciais temporárias com privilégios limitados para usuários do AWS Identity and Access Management (IAM) ou para usuários que você autentica (usuários federados).

Com o AWS STS, você pode:

Assumir roles do IAM: Solicite credenciais temporárias para acessar recursos AWS entre contas ou com permissões elevadas
Verificar identidade: Determine a conta AWS, o ARN e o user ID associados às credenciais de chamada
Gerar session tokens: Obtenha credenciais temporárias com proteção MFA opcional para maior segurança
Auditar access keys: Consulte a conta AWS que possui uma determinada access key para investigações de segurança

Na Zoen, a integração com o AWS STS permite que seus agentes gerenciem credenciais temporárias como parte de fluxos de trabalho automatizados. Isso é útil para padrões de acesso entre contas, rotação de credenciais, verificação de identidade antes de operações sensíveis e auditoria de segurança. Os agentes podem assumir roles para interagir com outros serviços AWS, verificar a própria identidade ou consultar a propriedade de access keys sem expor credenciais de longa duração.

Usage Instructions

Integrate AWS STS into the workflow. Assume roles, get temporary credentials, verify caller identity, and look up access key information.

Actions

`sts_assume_role`

Assume an IAM role and receive temporary security credentials

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`roleArn`	string	Yes	ARN of the IAM role to assume
`roleSessionName`	string	Yes	Identifier for the assumed role session
`durationSeconds`	number	No	Duration of the session in seconds (900-43200, default 3600)
`policy`	string	No	JSON IAM policy to further restrict session permissions (max 2048 chars)
`externalId`	string	No	External ID for cross-account access
`serialNumber`	string	No	MFA device serial number or ARN
`tokenCode`	string	No	MFA token code (6 digits)
`policyArns`	string	No	Comma-separated ARNs of up to 10 IAM managed policies to use as session policies
`tags`	string	No	JSON object of up to 50 session tag key/value pairs for attribute-based access control
`transitiveTagKeys`	string	No	Comma-separated tag keys that propagate through role chaining

Output

Parameter	Type	Description
`accessKeyId`	string	Temporary access key ID
`secretAccessKey`	string	Temporary secret access key
`sessionToken`	string	Temporary session token
`expiration`	string	Credential expiration timestamp
`assumedRoleArn`	string	ARN of the assumed role
`assumedRoleId`	string	Assumed role ID with session name
`packedPolicySize`	number	Percentage of allowed policy size used
`sourceIdentity`	string	Source identity set on the role session, if any

`sts_assume_role_with_web_identity`

Assume an IAM role using an OIDC/OAuth 2.0 web identity token (e.g. GitHub Actions OIDC, EKS IRSA, Google/Facebook federation) and receive temporary security credentials

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`roleArn`	string	Yes	ARN of the IAM role to assume
`roleSessionName`	string	Yes	Identifier for the assumed role session
`webIdentityToken`	string	Yes	OAuth 2.0 access token or OpenID Connect ID token from the identity provider (up to 20000 chars)
`providerId`	string	No	Fully qualified host of a legacy OAuth 2.0 provider (e.g. www.amazon.com\); omit for OpenID Connect providers
`policyArns`	string	No	Comma-separated ARNs of up to 10 IAM managed policies to use as session policies
`policy`	string	No	JSON IAM policy to further restrict session permissions (max 2048 chars)
`durationSeconds`	number	No	Duration of the session in seconds (900-43200, default 3600)

Output

Parameter	Type	Description
`accessKeyId`	string	Temporary access key ID
`secretAccessKey`	string	Temporary secret access key
`sessionToken`	string	Temporary session token
`expiration`	string	Credential expiration timestamp
`assumedRoleArn`	string	ARN of the assumed role
`assumedRoleId`	string	Assumed role ID with session name
`subjectFromWebIdentityToken`	string	Unique user identifier from the identity provider's token subject claim
`audience`	string	Intended audience (client ID) of the web identity token
`provider`	string	Issuing authority of the presented web identity token
`packedPolicySize`	number	Percentage of allowed policy size used
`sourceIdentity`	string	Source identity set on the role session, if any

`sts_assume_role_with_saml`

Assume an IAM role using a SAML 2.0 authentication response from an enterprise identity provider and receive temporary security credentials

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`roleArn`	string	Yes	ARN of the IAM role to assume
`principalArn`	string	Yes	ARN of the SAML provider in IAM that describes the identity provider
`samlAssertion`	string	Yes	Base64-encoded SAML authentication response from the identity provider
`policyArns`	string	No	Comma-separated ARNs of up to 10 IAM managed policies to use as session policies
`policy`	string	No	JSON IAM policy to further restrict session permissions (max 2048 chars)
`durationSeconds`	number	No	Duration of the session in seconds (900-43200, default 3600)

Output

Parameter	Type	Description
`accessKeyId`	string	Temporary access key ID
`secretAccessKey`	string	Temporary secret access key
`sessionToken`	string	Temporary session token
`expiration`	string	Credential expiration timestamp
`assumedRoleArn`	string	ARN of the assumed role
`assumedRoleId`	string	Assumed role ID with session name
`subject`	string	Value of the NameID element in the Subject of the SAML assertion
`subjectType`	string	Format of the name ID (e.g. transient, persistent)
`issuer`	string	Value of the Issuer element of the SAML assertion
`audience`	string	Value of the SAML assertion's SubjectConfirmationData Recipient attribute
`nameQualifier`	string	Hash uniquely identifying the issuer, account, and SAML provider
`packedPolicySize`	number	Percentage of allowed policy size used
`sourceIdentity`	string	Source identity set on the role session, if any

`sts_get_caller_identity`

Get details about the IAM user or role whose credentials are used to call the API

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key

Output

Parameter	Type	Description
`account`	string	AWS account ID
`arn`	string	ARN of the calling entity
`userId`	string	Unique identifier of the calling entity

`sts_get_session_token`

Get temporary security credentials for an IAM user, optionally with MFA

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`durationSeconds`	number	No	Duration of the session in seconds (900-129600, default 43200)
`serialNumber`	string	No	MFA device serial number or ARN
`tokenCode`	string	No	MFA token code (6 digits)

Output

Parameter	Type	Description
`accessKeyId`	string	Temporary access key ID
`secretAccessKey`	string	Temporary secret access key
`sessionToken`	string	Temporary session token
`expiration`	string	Credential expiration timestamp

`sts_get_access_key_info`

Get the AWS account ID associated with an access key

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`targetAccessKeyId`	string	Yes	The access key ID to look up

Output

Parameter	Type	Description
`account`	string	AWS account ID that owns the access key

AWS STS

On this page