Examples of com.amazonaws.services.securitytoken.model.AssumeRoleRequest

Package com.amazonaws.services.securitytoken.model

Examples of com.amazonaws.services.securitytoken.model.AssumeRoleRequest

com.amazonaws.services.securitytoken.model.AssumeRoleRequest
aws.amazon.com/IAM/latest/UserGuide/WorkingWithRoles.html"> Roles in Using IAM .

For federation, you can, for example, grant single sign-on access to the AWS Management Console. If you already have an identity and authentication system in your corporate network, you don't have to recreate user identities in AWS in order to grant those user identities access to AWS. Instead, after a user has been authenticated, you call AssumeRole (and specify the role with the appropriate permissions) to get temporary security credentials for that user. With those temporary security credentials, you construct a sign-in URL that users can use to access the console. For more information, see Scenarios for Granting Temporary Access in AWS Security Token Service .

The temporary security credentials are valid for the duration that you specified when calling AssumeRole , which can be from 900 seconds (15 minutes) to 3600 seconds (1 hour). The default is 1 hour.

The temporary security credentials that are returned from the AssumeRoleWithWebIdentity response have the permissions that are associated with the access policy of the role being assumed and any policies that are associated with the AWS resource being accessed. You can further restrict the permissions of the temporary security credentials by passing a policy in the request. The resulting permissions are an intersection of the role's access policy and the policy that you passed. These policies and any applicable resource-based policies are evaluated when calls to AWS service APIs are made using the temporary security credentials.

To assume a role, your AWS account must be trusted by the role. The trust relationship is defined in the role's trust policy when the IAM role is created. You must also have a policy that allows you to call sts:AssumeRole .

Important: You cannot call Assumerole by using AWS account credentials; access will be denied. You must use IAM user credentials to call AssumeRole .

@see com.amazonaws.services.securitytoken.AWSSecurityTokenService#assumeRole(AssumeRoleRequest)

     * Service (STS) to assume a Role using the long lived AWS credentials. This
     * class then vends the short lived session credentials for the assumed Role
     * sent back from STS.
     */
    private void startSession() {
        AssumeRoleRequest assumeRoleRequest = new AssumeRoleRequest()
            .withRoleArn(roleArn).withDurationSeconds(DEFAULT_DURATION_SECONDS)
            .withRoleSessionName(roleSessionName);
        if (roleExternalId != null) {
            assumeRoleRequest = assumeRoleRequest.withExternalId(roleExternalId);
        }
        AssumeRoleResult assumeRoleResult = securityTokenService.assumeRole(assumeRoleRequest);
        Credentials stsCredentials = assumeRoleResult.getCredentials();


        sessionCredentials = new BasicSessionCredentials(stsCredentials.getAccessKeyId(),

View Full Code Here

        if (cachedSessionCredentials != null) {
            return cachedSessionCredentials;
        }


        AWSSecurityTokenServiceClient client = new AWSSecurityTokenServiceClient();
        AssumeRoleRequest assumeRoleRequest = new AssumeRoleRequest()
                .withDurationSeconds(durationInSeconds)
                .withExternalId(externalId)
                .withRoleArn(awsCredential.getRoleArn())
                .withRoleSessionName("hadoop-provisioning");
        AssumeRoleResult result = client.assumeRole(assumeRoleRequest);

View Full Code Here

     * Service (STS) to assume a Role using the long lived AWS credentials. This
     * class then vends the short lived session credentials for the assumed Role
     * sent back from STS.
     */
    private void startSession() {
        AssumeRoleResult assumeRoleResult = securityTokenService.assumeRole(new AssumeRoleRequest()
                .withRoleArn(roleArn).withDurationSeconds(DEFAULT_DURATION_SECONDS).withRoleSessionName("SimianArmy"));
        Credentials stsCredentials = assumeRoleResult.getCredentials();
        sessionCredentials = new BasicSessionCredentials(stsCredentials.getAccessKeyId(),
                stsCredentials.getSecretAccessKey(), stsCredentials.getSessionToken());
        sessionCredentialsExpiration = stsCredentials.getExpiration();

View Full Code Here

     * @param accountId
     * @param assumeRole
     * @return assumes IAM credentials
     */
    public static Credentials getAssumedCredentials(String accountId, String assumeRole, String externalId) {
        AssumeRoleRequest assumeRoleRequest = new AssumeRoleRequest()
                .withRoleArn("arn:aws:iam::" + accountId + ":role/" + assumeRole)
                .withRoleSessionName(assumeRole.substring(0, Math.min(assumeRole.length(), 32)));
        if (!StringUtils.isEmpty(externalId))
            assumeRoleRequest.setExternalId(externalId);
        AssumeRoleResult roleResult = securityClient.assumeRole(assumeRoleRequest);
        return roleResult.getCredentials();
    }

View Full Code Here

     * Service (STS) to assume a Role using the long lived AWS credentials. This
     * class then vends the short lived session credentials for the assumed Role
     * sent back from STS.
     */
    private void startSession() {
        AssumeRoleResult assumeRoleResult = securityTokenService.assumeRole(new AssumeRoleRequest()
                .withRoleArn(roleArn).withDurationSeconds(DEFAULT_DURATION_SECONDS)
                .withRoleSessionName(roleSessionName));
        Credentials stsCredentials = assumeRoleResult.getCredentials();


        sessionCredentials = new BasicSessionCredentials(stsCredentials.getAccessKeyId(),

View Full Code Here

TOP

Related Classes of com.amazonaws.services.securitytoken.model.AssumeRoleRequest

com.amazonaws.auth.STSAssumeRoleSessionCredentialsProvider

com.netflix.ice.common.AwsUtils

com.netflix.simianarmy.aws.STSAssumeRoleSessionCredentialsProvider

com.sequenceiq.cloudbreak.service.credential.aws.CrossAccountCredentialsProvider

All source code are property of their respective owners. Java is a trademark of Sun Microsystems, Inc and owned by ORACLE Inc. Contact coftware#gmail.com.