For federation, you can, for example, grant single sign-on access to the AWS Management Console. If you already have an identity and authentication system in your corporate network, you don't have to recreate user identities in AWS in order to grant those user identities access to AWS. Instead, after a user has been authenticated, you call AssumeRole (and specify the role with the appropriate permissions) to get temporary security credentials for that user. With those temporary security credentials, you construct a sign-in URL that users can use to access the console. For more information, see Scenarios for Granting Temporary Access in AWS Security Token Service .
The temporary security credentials are valid for the duration that you specified when calling AssumeRole , which can be from 900 seconds (15 minutes) to 3600 seconds (1 hour). The default is 1 hour.
Optionally, you can pass an AWS IAM access policy to this operation. The temporary security credentials that are returned by the operation have the permissions that are associated with the access policy of the role that is being assumed, except for any permissions explicitly denied by the policy you pass. This gives you a way to further restrict the permissions for the federated user. These policies and any applicable resource-based policies are evaluated when calls to AWS are made using the temporary security credentials.
To assume a role, your AWS account must be trusted by the role. The trust relationship is defined in the role's trust policy when the IAM role is created. You must also have a policy that allows you to call sts:AssumeRole .
Important: You cannot call AssumeRole by using AWS account credentials; access will be denied. You must use IAM user credentials or temporary security credentials to call AssumeRole .
@param assumeRoleRequest Container for the necessary parameters toexecute the AssumeRole service method on AWSSecurityTokenService. @return The response from the AssumeRole service method, as returnedby AWSSecurityTokenService. @throws PackedPolicyTooLargeException @throws MalformedPolicyDocumentException @throws AmazonClientException If any internal errors are encountered inside the client while attempting to make the request or handle the response. For example if a network connection is not available. @throws AmazonServiceException If an error response is returned by AWSSecurityTokenService indicating either a problem with the data in the request, or a server side issue.
| |