Obtaining a Temporary Security Credential Through an Agency or Trust Agency

sts:agencies:assume

Write

agency *

g:ResourceTag/<tag-key>

-

• sts::tagSession
• sts::setSourceIdentity

-

• sts:ExternalId

• sts:SourceIdentity

• sts:TransitiveTagKeys

• sts:AgencySessionName

• g:RequestTag/<tag-key>

• g:TagKeys

• g:SourceAccount

• g:SourceUrn

• saml:namequalifier

• saml:sub

• saml:sub_type

X-Security-Token

No

String

Definition:

security_token field of a temporary security credential.

Constraints:

When an API is called using a temporary security credential, the HTTP header X-Security-Token must be provided.

Range:

N/A

Default Value:

N/A

duration_seconds

No

Integer

Definition:

Validity period (in seconds) of the obtained temporary security credential.

Constraints:

Note that the duration must be less than the maximum session duration set for the agency and cannot exceed 3,600 seconds when the X-Security-Token header is carried.

Range:

The value ranges from 900 to 43200.

Default Value:

The default value is 3600.

external_id

No

String

Definition:

External ID, which prevents confused deputy issues.

Constraints:

The value contains 2 to 1,224 characters.

Range:

N/A.

Default Value:

N/A.

policy

No

String

Definition :

Custom policy. For details, see Reference.

Constraints:

The permission scope of the temporary security credential obtained in this session cannot exceed the permission scope specified in the custom policy.

The value contains 2 to 2,048 characters.

Range:

N/A.

Default Value:

N/A.

policy_ids

No

Array of strings

Definition:

List of preset policies. The permission scope of the temporary security credential obtained in this session cannot exceed the permissions specified in the preset policies.

Constraints:

N/A

Range:

N/A

Default Value:

N/A

agency_urn

Yes

String

Definition:

URN of a target agency.

Constraints:

The value contains 0 to 1,500 characters.

Range:

N/A

Default Value:

N/A

agency_session_name

Yes

String

Definition:

Name of the assumed-agency session.

Constraints:

The value contains 2 to 128 characters.

Range:

N/A

Default Value:

N/A

serial_number

No

String

Definition:

Serial number of the MFA device bound to the caller.

Constraints:

The value contains 9 to 256 characters.

Range:

N/A

Default Value:

N/A

token_code

No

String

Definition:

6-digit code of the MFA device bound to the caller.

Constraints:

The value contains 6 characters.

Range:

N/A

Default Value:

N/A

source_identity

No

String

Definition:

Identity declared by the initial caller in the call chain.

Constraints:

The value contains 2 to 64 characters.

Range:

N/A

Default Value:

N/A

tags

No

Array of TagDto objects

Definition:

List of custom tags.

Constraints:

N/A

Range:

N/A

Default Value:

N/A

transitive_tag_keys

No

Array of strings

Definition:

List of tag keys that are continuously transparently transmitted along with the temporary security credential call chain.

Constraints:

N/A

Range:

N/A

Default Value:

N/A

key

Yes

String

Definition:

Tag key.

Constraints:

The value contains 1 to 128 characters.

Range:

N/A

Default Value:

N/A

value

Yes

String

Definition:

Tag value.

Constraints:

The value contains 0 to 255 characters.

Range:

The value can be an empty string but cannot be null.

Default Value:

N/A

source_identity

String

Definition:

Identity declared by the initial caller in the call chain.

Range:

N/A

assumed_agency

AssumedAgencyDto object

Definition:

Information about an agency session or trust agency session.

Range:

N/A

credentials

CredentialsDto object

Definition:

Generated temporary security credentials.

Range:

N/A

urn

String

Definition:

URN of an agency session or trust agency session.

Range:

N/A

id

String

Definition:

Unique identifier of an agency session or trust agency session, including the agency ID and agency session name.

Range:

N/A

access_key_id

String

Definition:

AK of the temporary security credential.

Range:

N/A

expiration

String

Definition:

Expiration time of the temporary security credential.

Range:

N/A

secret_access_key

String

Definition:

SK of the temporary security credential.

Range:

N/A

security_token

String

Definition:

security_token of the temporary security credential.

Range:

N/A

error_code

String

Definition :

Error code. For details, see Error Code.

Range:

The format is STS5.XXXX, for example, STS5.1001.

error_msg

String

Definition :

Error message. For details, see Error Message.

Range:

N/A.

error_code

String

Definition :

Error code. For details, see Error Code.

Range:

The format is STS5.XXXX, for example, STS5.1001.

error_msg

String

Definition :

Error message. For details, see Error Message.

Range:

N/A.

encoded_authorization_message

String

Definition :

Encrypted details returned when the authentication fails, which are used to locate authentication problems. The STS5 decryption API can be used for decryption. For details, see API link.

Range:

N/A.

error_code

String

Definition :

Error code. For details, see Error Code.

Range:

The format is STS5.XXXX, for example, STS5.1001.

error_msg

String

Definition :

Error message. For details, see Error Message.

Range:

N/A.

error_code

String

Definition :

Error code. For details, see Error Code.

Range:

The format is STS5.XXXX, for example, STS5.1001.

error_msg

String

Definition :

Error message. For details, see Error Message.

Range:

N/A.

200

Successful

400

Bad request

403

Forbidden

404

Not found

500

Server error