Lua

AWS Security Token Service (STS) AssumeRole

See more AWS Security Token Service Examples

Returns a set of temporary security credentials that you can use to access AWS resources. These temporary credentials consist of an access key ID, a secret access key, and a security token. Typically, you use AssumeRole within your account or for cross-account access. Lua

local chilkat = require("chilkat")

-- This example requires the Chilkat API to have been previously unlocked.
-- See Global Unlock Sample for sample code.

local rest = chilkat.Rest.new()

-- Connect to the Amazon AWS REST server.
-- such as https://sts.us-west-2.amazonaws.com/
local bTls = true
local port = 443
local bAutoReconnect = true
local success = rest:connect("sts.us-west-2.amazonaws.com", port, bTls, bAutoReconnect)

-- Provide AWS credentials for the REST call.
local authAws = chilkat.AuthAws.new()
authAws.access_key = "AWS_ACCESS_KEY"
authAws.secret_key = "AWS_SECRET_KEY"
-- the region should match our URL above..
-- See https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html
authAws.region = "us-west-2"
authAws.service_name = "sts"

rest:set_auth_aws(authAws)

-- Sample Request
-- https://sts.amazonaws.com/
-- ?Version=2011-06-15
-- &Action=AssumeRole
-- &RoleSessionName=testAR
-- &RoleArn=arn:aws:iam::123456789012:role/demo
-- &PolicyArns.member.1.arn=arn:aws:iam::123456789012:policy/demopolicy1
-- &PolicyArns.member.2.arn=arn:aws:iam::123456789012:policy/demopolicy2
-- &Policy={"Version":"2012-10-17","Statement":[{"Sid":"Stmt1",
-- "Effect":"Allow","Action":"s3:*","Resource":"*"}]}
-- &DurationSeconds=3600
-- &Tags.member.1.Key=Project
-- &Tags.member.1.Value=Pegasus
-- &Tags.member.2.Key=Team
-- &Tags.member.2.Value=Engineering
-- &Tags.member.3.Key=Cost-Center
-- &Tags.member.3.Value=12345
-- &TransitiveTagKeys.member.1=Project
-- &TransitiveTagKeys.member.2=Cost-Center
-- &ExternalId=123ABC
-- &SourceIdentity=Alice
-- &AUTHPARAMS

rest:add_query_param("Version", "2011-06-15")
rest:add_query_param("Action", "AssumeRole")
rest:add_query_param("DurationSeconds", "3600")

rest:add_query_param("RoleSessionName", "testAR")
rest:add_query_param("RoleArn", "arn:aws:iam::123456789012:role/demo")
rest:add_query_param("PolicyArns.member.1.arn", "arn:aws:iam::123456789012:policy/demopolicy1")
rest:add_query_param("PolicyArns.member.2.arn", "arn:aws:iam::123456789012:policy/demopolicy2")
rest:add_query_param("Policy", "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Sid\":\"Stmt1\",\"Effect\":\"Allow\",\"Action\":\"s3:*\",\"Resource\":\"*\"}]}")
rest:add_query_param("Tags.member.1.Key", "Project")
rest:add_query_param("Tags.member.1.Value", "Pegasus")
rest:add_query_param("Tags.member.2.Key", "Team")
rest:add_query_param("Tags.member.2.Value", "Engineering")
rest:add_query_param("Tags.member.3.Key", "Cost-Center")
rest:add_query_param("Tags.member.3.Value", "12345")
rest:add_query_param("TransitiveTagKeys.member.1", "Project")
rest:add_query_param("TransitiveTagKeys.member.2", "Cost-Center")
rest:add_query_param("ExternalId", "123ABC")
rest:add_query_param("SourceIdentity", "Alice")

local responseXml = rest:full_request_no_body("GET", "/")
if not rest.last_method_success then
    print(rest.last_error_text)
    return
end

-- A successful response will have a status code equal to 200.
if rest.response_status_code ~= 200 then
    print("response status code = " .. rest.response_status_code)
    print("response status text = " .. rest.response_status_text)
    print("response header: " .. rest.response_header)
    print("response body: " .. responseXml)
    return
end

-- Examine the successful XML response (shown below)
local xml = chilkat.Xml.new()
xml:load_xml(responseXml)
print(xml:get_xml())

-- Sample response:

-- <AssumeRoleResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
--   <AssumeRoleResult>
--   <SourceIdentity>Alice</SourceIdentity>
--     <AssumedRoleUser>
--       <Arn>arn:aws:sts::123456789012:assumed-role/demo/TestAR</Arn>
--       <AssumedRoleId>ARO123EXAMPLE123:TestAR</AssumedRoleId>
--     </AssumedRoleUser>
--     <Credentials>
--       <AccessKeyId>ASIAIOSFODNN7EXAMPLE</AccessKeyId>
--       <SecretAccessKey>wJalrXUtnFEMI/K7MDENG/bPxRfiCYzEXAMPLEKEY</SecretAccessKey>
--       <SessionToken>
--        AQoDYXdzEPT//////////wEXAMPLEtc764bNrC9SAPBSM22wDOk4x4HIZ8j4FZTwdQW
--        LWsKWHGBuFqwAeMicRXmxfpSPfIeoIYRqTflfKD8YUuwthAx7mSEI/qkPpKPi/kMcGd
--        QrmGdeehM4IC1NtBmUpp2wUE8phUZampKsburEDy0KPkyQDYwT7WZ0wq5VSXDvp75YU
--        9HFvlRd8Tx6q6fE8YQcHNVXAkiY9q6d+xo0rKwT38xVqr7ZD0u0iPPkUL64lIZbqBAz
--        +scqKmlzm8FDrypNC9Yjc8fPOLn9FX9KSYvKTr4rvx3iSIlTJabIQwj2ICCR/oLxBA==
--       </SessionToken>
--       <Expiration>2019-11-09T13:34:41Z</Expiration>
--     </Credentials>
--     <PackedPolicySize>6</PackedPolicySize>
--   </AssumeRoleResult>
--   <ResponseMetadata>
--     <RequestId>c6104cbe-af31-11e0-8154-cbc7ccf896c7</RequestId>
--   </ResponseMetadata>
-- </AssumeRoleResponse>

-- Sample parse code:

local AssumeRoleResponse_xmlns = xml:get_attr_value("xmlns")
local SourceIdentity = xml:get_child_content("AssumeRoleResult|SourceIdentity")
local Arn = xml:get_child_content("AssumeRoleResult|AssumedRoleUser|Arn")
local AssumedRoleId = xml:get_child_content("AssumeRoleResult|AssumedRoleUser|AssumedRoleId")
local AccessKeyId = xml:get_child_content("AssumeRoleResult|Credentials|AccessKeyId")
local SecretAccessKey = xml:get_child_content("AssumeRoleResult|Credentials|SecretAccessKey")
local SessionToken = xml:get_child_content("AssumeRoleResult|Credentials|SessionToken")
local Expiration = xml:get_child_content("AssumeRoleResult|Credentials|Expiration")
local PackedPolicySize = xml:get_child_int_value("AssumeRoleResult|PackedPolicySize")
local RequestId = xml:get_child_content("ResponseMetadata|RequestId")

-- Save the session token XML to a file for use by another Chilkat example..
success = xml:save_xml("qa_data/tokens/aws_session_token.xml")