Docs
Open Lodol
DocumentationIntegrationsAPI

Amazon STS

App · Compliance & Security · 7 actions

Use the AWS Security Token Service: check which account and identity a key belongs to, issue temporary credentials by assuming a role or requesting a session or federation token, decode access-denied messages, and issue JWTs for outbound federation.

Actions

ActionWhat it does
Assume roleIssue temporary credentials for an IAM role whose trust policy trusts the connected user or account.
Decode authorization messageDecode the 'Encoded authorization failure message' from an AWS access-denied error, to see which policy denied what.
Get access key infoFind the AWS account that owns an access key ID, from any account.
Get caller identityShow which AWS account and IAM principal the connection acts as.
Get federation tokenIssue temporary credentials for a named federated user, limited by a session policy you pass.
Get session tokenIssue temporary credentials with the connected user's own permissions, optionally MFA-authenticated.
Get web identity tokenIssue a signed JWT that proves this AWS identity to an external service (outbound identity federation).

Assume role

Issue temporary credentials for an IAM role whose trust policy trusts the connected user or account. The result contains a secret access key and session token: anyone who can see this workflow's run history can use them until they expire.

Inputs

Role ARNrole_arntextRequired
The role to assume: its ARN (arn:aws:iam::123456789012:role/MyRole), or just the role's name for a role in the connected account.
Session namerole_session_nametextRequired
A name for this session, 2-64 letters, digits or _ + = , . @ -. It appears in the session's ARN and in CloudTrail.
Duration (seconds)duration_secondsnumber
How long the result stays valid, 900-43200 seconds. Default 3600; cannot exceed the role's maximum session duration.From 900 to 43200.
Session policypolicytext
Optional IAM policy document (JSON) that further limits the session's permissions. It can only narrow them, never add any.
Session policy ARNspolicy_arnslist
Up to 10 managed policy ARNs (or AWS managed policy names such as 'ReadOnlyAccess') that further limit the session's permissions.
Session tagstagsobject
Optional tags passed into the session as key/value pairs.
Transitive tag keystransitive_tag_keyslist
Session tag keys that carry over if this session assumes another role.
External IDexternal_idtext
Only if the role's trust policy requires one (sts:ExternalId condition).
MFA device ARNmfa_serial_numbertext
Only if MFA is required: the device's ARN (arn:aws:iam::123456789012:mfa/device-name), from IAM > Users > your user > Security credentials.
MFA codemfa_token_codetext
The 6-digit code the MFA device shows now. Required with the device ARN.
Source identitysource_identitytext
Optional identity of the person behind the session, recorded in CloudTrail (2-64 characters).

Outputs

resultobject
Example output
{
  "result": {
    "assumed_role_user": {
      "arn": "arn:aws:sts::123456789012:assumed-role/LodolRole/lodol-session",
      "assumed_role_id": "AROA3XFRBF535PLBIFPI4:lodol-session"
    },
    "credentials": {
      "access_key_id": "ASIAIOSFODNN7EXAMPLE",
      "expiration": "2026-09-25T22:00:00Z",
      "secret_access_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
      "session_token": "IQoJb3JpZ2luX2VjEXAMPLETOKEN"
    },
    "session_token_size": null,
    "session_token_utilization": null,
    "source_identity": null
  }
}

Decode authorization message

Decode the 'Encoded authorization failure message' from an AWS access-denied error, to see which policy denied what.

Inputs

Encoded messageencoded_messagetextRequired
The encoded message from the error, or the whole error text. Line breaks are removed automatically.

Outputs

resultobject
Example output
{
  "result": {
    "allowed": false,
    "decoded_message": {
      "allowed": false,
      "context": {
        "action": "ec2:RunInstances",
        "resource": "arn:aws:ec2:us-east-1:123456789012:instance/*"
      },
      "explicitDeny": false
    },
    "decoded_message_raw": "{\"allowed\":false}"
  }
}

Get access key info

Find the AWS account that owns an access key ID, from any account. It does not say whether the key is still active.

Inputs

Access key IDaccess_key_idtextRequired
The access key ID to look up, e.g. AKIAIOSFODNN7EXAMPLE.

Outputs

resultobject
Example output
{
  "result": {
    "access_key_id": "AKIAIOSFODNN7EXAMPLE",
    "account": "123456789012",
    "key_type": "long-term"
  }
}

Get caller identity

Show which AWS account and IAM principal the connection acts as. Needs no permissions, so it also tests the connection.

Inputs

None.

Outputs

resultobject
Example output
{
  "result": {
    "account": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/lodol",
    "principal_name": "lodol",
    "principal_type": "user",
    "user_id": "AIDASAMPLEUSERID"
  }
}

Get federation token

Issue temporary credentials for a named federated user, limited by a session policy you pass. The result contains a secret access key and session token: anyone who can see this workflow's run history can use them until they expire.

Inputs

Federated user namenametextRequired
2-32 letters, digits or _ + = , . @ -. It appears in the federated user's ARN.
Session policypolicytext
An IAM policy document (JSON) granting the session's permissions, intersected with the connected user's. Pass this or policy ARNs: without either the session has no permissions.
Session policy ARNspolicy_arnslist
Up to 10 managed policy ARNs (or AWS managed policy names such as 'ReadOnlyAccess') that further limit the session's permissions.
Duration (seconds)duration_secondsnumber
How long the result stays valid, 900-129600 seconds. Default 43200 (12 hours).From 900 to 129600.
Session tagstagsobject
Optional tags passed into the session as key/value pairs.

Outputs

resultobject
Example output
{
  "result": {
    "credentials": {
      "access_key_id": "ASIAIOSFODNN7EXAMPLE",
      "expiration": "2026-09-25T22:00:00Z",
      "secret_access_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
      "session_token": "IQoJb3JpZ2luX2VjEXAMPLETOKEN"
    },
    "federated_user": {
      "arn": "arn:aws:sts::123456789012:federated-user/lodol-user",
      "federated_user_id": "123456789012:lodol-user"
    },
    "session_token_size": null,
    "session_token_utilization": null
  }
}

Get session token

Issue temporary credentials with the connected user's own permissions, optionally MFA-authenticated. The result contains a secret access key and session token: anyone who can see this workflow's run history can use them until they expire.

Inputs

Duration (seconds)duration_secondsnumber
How long the result stays valid, 900-129600 seconds. Default 43200 (12 hours).From 900 to 129600.
MFA device ARNmfa_serial_numbertext
Only if MFA is required: the device's ARN (arn:aws:iam::123456789012:mfa/device-name), from IAM > Users > your user > Security credentials.
MFA codemfa_token_codetext
The 6-digit code the MFA device shows now. Required with the device ARN.

Outputs

resultobject
Example output
{
  "result": {
    "credentials": {
      "access_key_id": "ASIAIOSFODNN7EXAMPLE",
      "expiration": "2026-09-25T22:00:00Z",
      "secret_access_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
      "session_token": "IQoJb3JpZ2luX2VjEXAMPLETOKEN"
    },
    "session_token_size": null,
    "session_token_utilization": null
  }
}

Get web identity token

Issue a signed JWT that proves this AWS identity to an external service (outbound identity federation). The token is a credential: anyone who can see this workflow's run history can present it until it expires.

Inputs

AudienceaudiencelistRequired
1-10 intended recipients, placed in the token's 'aud' claim, e.g. 'https://api.example.com'.
Signing algorithmsigning_algorithmtextRequired
How the token is signed.One of: RS256 (RS256 (RSA)), ES384 (ES384 (ECDSA P-384)).
Duration (seconds)duration_secondsnumber
How long the result stays valid, 60-3600 seconds. Default 300.From 60 to 3600.
Custom claimstagsobject
Optional key/value pairs added to the token as claims.

Outputs

resultobject
Example output
{
  "result": {
    "expiration": "2026-09-25T20:05:00Z",
    "web_identity_token": "eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJ4In0.sig"
  }
}

Amazon SQS

Previous Page

AmiiboAPI

Next Page

On this page

ActionsAssume roleDecode authorization messageGet access key infoGet caller identityGet federation tokenGet session tokenGet web identity token