Assume Role as a Web Identity¶

Prerequisites¶

An IAM role ARN in AccountExample (ID=123456789) with a trust policy allowing the Web Identity to assume the role.

Procedure¶

Using the CLI

Get an OIDC token from ARTESCA Identity Provider.

content=$(curl -k -d "client_id=zenko-ui" -d "username=<YOUR_ARTESCA-Identity-Provider_USERNAME>" -d "password=<YOUR_ARTESCA-Identity-Provider_PASSWORD>" -d "grant_type=password" "https://ui.<base-domain-name>/auth/realms/artesca/protocol/openid-connect/token") && token=$( jq -r '.access_token' <<< "${content}" )

Initiate a new session using the OIDC token and the ARN role.
```
session=$(aws sts assume-role-with-web-identity --role-session-name session-name --role-arn <ROLE_ARN> \ --endpoint https://sts.<base-domain-name> --web-identity-token "${token}") && echo $session
```
<ROLE_ARN> is an IAM role ARN you created, or one of the default ARTESCA roles:
- arn:aws:iam::123456789:role/scality-internal/storage-manager-role
- arn:aws:iam::123456789:role/scality-internal/storage-account-owner-role
- arn:aws:iam::123456789:role/scality-internal/data-consumer-role
The command should display your temporary credentials. If an error message indicates that your user is not authorized to run AssumeRoleWithWebIdentity on the specific role you are targeting, make sure that you have successfully followed the procedure above and the user provided is properly configured in ARTESCA Identity Provider.

Output example:
```
{
    "AssumedRoleUser": {
        "Arn": "arn:aws:sts::123456789012:assumed-role/<ROLE_NAME>/session-name",
        "AssumedRoleId": "AROACLKWSDQRAOEXAMPLE:app1"
    }
    "Credentials": {
        "AccessKeyId": "AKIAIOSFODNN7EXAMPLE",
        "SecretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYzEXAMPLEKEY",
        "SessionToken": "AQoEXAMPLEH4aoAE",
        "Expiration": "2020-05-19T18:06:10+00:00"
    },
    "Provider": "www.scality.com"
}
```
Note

Refer to Use AWS CLI with Temporary Credentials to start using those temporary credentials.

Using the API

The assume-role-with-web-identity API enables the Web Identity to assume a role in an account.