ObtainCloudAccountRoleAccessCredential-阿里云帮助中心

Gets temporary access credentials for a CloudAccountRole.

Operation description

This API uses IDaaS-issued access tokens to authenticate and authorize requests.

The access token must be authorized to obtain access credentials for a cloud role from the IDaaS Privileged Access Management (PAM) application.

Note

The corresponding scope is urn:cloud:idaas:pam|cloud_account_role:obtain_access_credential.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

No authorization for this operation. If you encounter issues with this operation, contact technical support.

Request syntax

GET /v2/{instanceId}/cloudAccountRoles/_/actions/obtainAccessCredential HTTP/1.1

Path Parameters

Parameter	Type	Required	Description	Example
instanceId	string	Yes	The instance ID.	idaas_ue2jvisn35ea5lmthk267xxxxx

Request parameters

Parameter	Type	Required	Description	Example
Authorization	string	Yes	Authentication information. The format is `Bearer ${access_token}`. Note The access token is issued by IDaaS.	Bearer xxxxxx
cloudAccountRoleExternalId	string	Yes	The external ID of the cloud role.	acs:ram::xxx:role/role-test
durationSeconds	integer	No	The duration of the temporary security credentials (STS token) in seconds. The value must be between 900 and 43200 (15 minutes to 12 hours). The minimum value is 900 seconds. The maximum value is limited by the maximum session duration of the cloud provider's role or service account. For example, the default maximum session duration for an AWS role is 3,600 seconds.	1800

Response elements

Element	Type	Description	Example
	object
cloudAccountId	string	The ID of the cloud account.	ca_01kmegjc11qa1txxxxx
cloudAccountRoleId	string	The ID of the cloud role.	carole_01kmek49aqxxxx
cloudAccountRoleName	string	The name of the cloud role.	role-test
cloudAccountRoleExternalId	string	The external ID of the cloud role.	acs:ram::xxx:role/role-test
cloudAccountVendorType	string	The type of the cloud account. The valid value is: `alibaba_cloud`: Alibaba Cloud Valid values: alibaba_cloud : alibaba_cloud	alibaba_cloud
cloudAccountRoleAccessCredential	object	The temporary access credential to assume the cloud role.
accessCredentialExpiresAt	integer	The expiration time of the temporary access credential for the cloud role, in Unix timestamp seconds.	1767196800
alibabaCloudStsToken	object	The STS token used to assume an Alibaba Cloud RAM role. Note This parameter is returned only when the cloud account type is `alibaba_cloud`.
accessKeyId	string	The access key ID.	STS.NUgYrLnoC37mZZCNnAbez****
accessKeySecret	string	The access key secret.	CVwjCkNzTMupZ8NbTCxCBRq3K16jtcWFTJAyBEv2****
securityToken	string	The security token.	CAIShwJ1q6Ft5B2yfSjIr5bSEsj4g7BihPWGWHz****
expiration	string	The expiration time of the token, in UTC.	2021-10-20T04:27:09Z
awsStsToken	object	The STS token used to assume an AWS role.
accessKeyId	string	The access key ID.	ASIAYBGN7XJKRFOM****
secretAccessKey	string	The secret access key.	CVwjCkNzTMupZ8NbTCxCBRq3K16jtcWFTJAyBEv2****
sessionToken	string	The session token.	FwoDYXdzEJzfSjIr5bSEsj4g7BihPWGWHz****
expiration	string	The expiration time of the STS token, in UTC.	2021-10-20T04:27:09Z

Examples

Success response

JSON format

{
  "cloudAccountId": "ca_01kmegjc11qa1txxxxx",
  "cloudAccountRoleId": "carole_01kmek49aqxxxx",
  "cloudAccountRoleName": "role-test",
  "cloudAccountRoleExternalId": "acs:ram::xxx:role/role-test",
  "cloudAccountVendorType": "alibaba_cloud",
  "cloudAccountRoleAccessCredential": {
    "accessCredentialExpiresAt": 1767196800,
    "alibabaCloudStsToken": {
      "accessKeyId": "STS.NUgYrLnoC37mZZCNnAbez****",
      "accessKeySecret": "CVwjCkNzTMupZ8NbTCxCBRq3K16jtcWFTJAyBEv2****",
      "securityToken": "CAIShwJ1q6Ft5B2yfSjIr5bSEsj4g7BihPWGWHz****",
      "expiration": "2021-10-20T04:27:09Z"
    },
    "awsStsToken": {
      "accessKeyId": "ASIAYBGN7XJKRFOM****",
      "secretAccessKey": "CVwjCkNzTMupZ8NbTCxCBRq3K16jtcWFTJAyBEv2****",
      "sessionToken": "FwoDYXdzEJzfSjIr5bSEsj4g7BihPWGWHz****\n",
      "expiration": "2021-10-20T04:27:09Z"
    }
  }
}

Error codes

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.