DocsICP FilingConsole
Documentation

AssumeRoleWithOIDC

Updated at:
Copy as MD
Product
My Favorites

Obtains an STS token to assume a RAM role during OIDC-based role SSO.

Operation description

Prerequisites

Try it now

Run this API in OpenAPI Explorer without manual signing. Successful calls auto-generate SDK code samples.

Test

RAM authorization

No authorization for this operation. If you encounter issues with this operation, contact technical support.

Request parameters

Parameter

Type

Required

Description

Example

OIDCProviderArn

string

No

The ARN of the OIDC IdP.

View the ARN:

acs:ram::113511544585****:oidc-provider/TestOidcIdp

RoleArn

string

No

The ARN of the RAM role.

View the ARN:

acs:ram::113511544585****:role/testoidc

OIDCToken

string

No

The OIDC token issued by the external IdP.

Length: 4–20,000 characters.

Note

You must enter the original OIDC token (not the Base64-encoded token).

eyJraWQiOiJKQzl3eHpyaHFKMGd0****

Policy

string

No

The permissions policy for the STS token. Use this to further restrict permissions beyond what the RAM role grants.

  • If specified, the STS token permissions are the intersection of this policy and the RAM role permissions.

  • If not specified, the STS token inherits all RAM role permissions.

Length: 1–2,048 characters.

{"Statement": [{"Action": ["*"],"Effect": "Allow","Resource": ["*"]}],"Version":"1"}

DurationSeconds

integer

No

The validity period of the STS token. Unit: seconds.

Default value: 3600. Minimum value: 900. Maximum value: the value of the MaxSessionDuration parameter.

Configure MaxSessionDuration via CreateRole or UpdateRole.

3600

RoleSessionName

string

Yes

The custom name of the role session.

Set this to a user-specific identifier (such as a username) for ActionTrail audit tracing.

Allowed characters: letters, digits, periods (.), at signs (@), hyphens (-), and underscores (_).

Length: 2–64 characters.

TestOidcAssumedRoleSession
Note

AssumeRoleWithOIDC authenticates via OIDC tokens, so anonymous calls are allowed. You do not need to specify Signature, SignatureMethod, SignatureVersion, or AccessKeyId. Common parameters.

Response elements

Parameter

Type

Description

Example

object

The response parameters.

RequestId

string

The request ID.

3D57EAD2-8723-1F26-B69C-F8707D8B565D
OIDCTokenInfo

object

The OIDC token information.

Subject

string

The OIDC token subject.

Corresponds to the sub field in the OIDC token.

KryrkIdjylZb7agUgCEf****

Issuer

string

The issuer URL.

Corresponds to the iss field in the OIDC token.

https://dev-xxxxxx.okta.com

ClientIds

string

The audience. Multiple audiences are separated by commas (,).

Corresponds to the aud field in the OIDC token.

496271242565057****

ExpirationTime

string

The OIDC token expiration time.

2021-10-20T04:27:09Z

IssuanceTime

string

The OIDC token issuance time.

2021-10-20T03:27:09Z

VerificationInfo

string

The OIDC token verification details. Manage an OIDC IdP.

Success
AssumedRoleUser

object

The temporary identity used to assume the RAM role.

AssumedRoleId

string

The ID of the temporary identity.

33157794895460****

Arn

string

The ARN of the temporary identity.

acs:ram::113511544585****:role/testoidc/TestOidcAssumedRoleSession
Credentials

object

The access credentials.

SecurityToken

string

The STS token.

Note

STS token length is variable. Do not set a maximum length in your application.

CAIShwJ1q6Ft5B2yfSjIr5bSEsj4g7BihPWGWHz****

Expiration

string

The STS token expiration time in UTC.

2021-10-20T04:27:09Z

AccessKeySecret

string

The AccessKey secret.

CVwjCkNzTMupZ8NbTCxCBRq3K16jtcWFTJAyBEv2****

AccessKeyId

string

The AccessKey ID.

STS.NUgYrLnoC37mZZCNnAbez****

SourceIdentity

string

The source identity of the principal that assumed the role.

Set SourceIdentity when calling AssumeRole to tag the session with the original caller identity. This value is immutable and persists through role-chaining, enabling audit tracing.

Returned only when SourceIdentity is set in the AssumeRole call.

Alice

Examples

Success response

JSON format

{
  "RequestId": "3D57EAD2-8723-1F26-B69C-F8707D8B565D",
  "OIDCTokenInfo": {
    "Subject": "KryrkIdjylZb7agUgCEf****",
    "Issuer": "https://dev-xxxxxx.okta.com",
    "ClientIds": "496271242565057****",
    "ExpirationTime": "2021-10-20T04:27:09Z",
    "IssuanceTime": "2021-10-20T03:27:09Z",
    "VerificationInfo": "Success"
  },
  "AssumedRoleUser": {
    "AssumedRoleId": "33157794895460****",
    "Arn": "acs:ram::113511544585****:role/testoidc/TestOidcAssumedRoleSession"
  },
  "Credentials": {
    "SecurityToken": "CAIShwJ1q6Ft5B2yfSjIr5bSEsj4g7BihPWGWHz****",
    "Expiration": "2021-10-20T04:27:09Z",
    "AccessKeySecret": "CVwjCkNzTMupZ8NbTCxCBRq3K16jtcWFTJAyBEv2****",
    "AccessKeyId": "STS.NUgYrLnoC37mZZCNnAbez****"
  },
  "SourceIdentity": "Alice"
}

Error codes

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.