# Amazon STS

> Use the AWS Security Token Service: check which account and identity a key belongs to, issue temporary credentials by assuming a role or requesting a session or federation token, decode access-denied messages, and issue JWTs for outbound federation.

App · Compliance & Security · 7 actions. Web page: https://docs.lodol.com/docs/integrations/amazon-sts

## Actions

### Assume role

Issue temporary credentials for an IAM role whose trust policy trusts the connected user or account. The result contains a secret access key and session token: anyone who can see this workflow's run history can use them until they expire.

**Inputs**

- Role ARN (`role_arn`, text, required): The role to assume: its ARN (arn:aws:iam::123456789012:role/MyRole), or just the role's name for a role in the connected account.
- Session name (`role_session_name`, text, required): A name for this session, 2-64 letters, digits or _ + = , . @ -. It appears in the session's ARN and in CloudTrail.
- Duration (seconds) (`duration_seconds`, number): How long the result stays valid, 900-43200 seconds. Default 3600; cannot exceed the role's maximum session duration. From 900 to 43200.
- Session policy (`policy`, text): Optional IAM policy document (JSON) that further limits the session's permissions. It can only narrow them, never add any.
- Session policy ARNs (`policy_arns`, list): Up to 10 managed policy ARNs (or AWS managed policy names such as 'ReadOnlyAccess') that further limit the session's permissions.
- Session tags (`tags`, object): Optional tags passed into the session as key/value pairs.
- Transitive tag keys (`transitive_tag_keys`, list): Session tag keys that carry over if this session assumes another role.
- External ID (`external_id`, text): Only if the role's trust policy requires one (sts:ExternalId condition).
- MFA device ARN (`mfa_serial_number`, text): Only if MFA is required: the device's ARN (arn:aws:iam::123456789012:mfa/device-name), from IAM > Users > your user > Security credentials.
- MFA code (`mfa_token_code`, text): The 6-digit code the MFA device shows now. Required with the device ARN.
- Source identity (`source_identity`, text): Optional identity of the person behind the session, recorded in CloudTrail (2-64 characters).

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "assumed_role_user": {
      "arn": "arn:aws:sts::123456789012:assumed-role/LodolRole/lodol-session",
      "assumed_role_id": "AROA3XFRBF535PLBIFPI4:lodol-session"
    },
    "credentials": {
      "access_key_id": "ASIAIOSFODNN7EXAMPLE",
      "expiration": "2026-09-25T22:00:00Z",
      "secret_access_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
      "session_token": "IQoJb3JpZ2luX2VjEXAMPLETOKEN"
    },
    "session_token_size": null,
    "session_token_utilization": null,
    "source_identity": null
  }
}
```

### Decode authorization message

Decode the 'Encoded authorization failure message' from an AWS access-denied error, to see which policy denied what.

**Inputs**

- Encoded message (`encoded_message`, text, required): The encoded message from the error, or the whole error text. Line breaks are removed automatically.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "allowed": false,
    "decoded_message": {
      "allowed": false,
      "context": {
        "action": "ec2:RunInstances",
        "resource": "arn:aws:ec2:us-east-1:123456789012:instance/*"
      },
      "explicitDeny": false
    },
    "decoded_message_raw": "{\"allowed\":false}"
  }
}
```

### Get access key info

Find the AWS account that owns an access key ID, from any account. It does not say whether the key is still active.

**Inputs**

- Access key ID (`access_key_id`, text, required): The access key ID to look up, e.g. AKIAIOSFODNN7EXAMPLE.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "access_key_id": "AKIAIOSFODNN7EXAMPLE",
    "account": "123456789012",
    "key_type": "long-term"
  }
}
```

### Get caller identity

Show which AWS account and IAM principal the connection acts as. Needs no permissions, so it also tests the connection.

**Inputs**: None.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "account": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/lodol",
    "principal_name": "lodol",
    "principal_type": "user",
    "user_id": "AIDASAMPLEUSERID"
  }
}
```

### Get federation token

Issue temporary credentials for a named federated user, limited by a session policy you pass. The result contains a secret access key and session token: anyone who can see this workflow's run history can use them until they expire.

**Inputs**

- Federated user name (`name`, text, required): 2-32 letters, digits or _ + = , . @ -. It appears in the federated user's ARN.
- Session policy (`policy`, text): An IAM policy document (JSON) granting the session's permissions, intersected with the connected user's. Pass this or policy ARNs: without either the session has no permissions.
- Session policy ARNs (`policy_arns`, list): Up to 10 managed policy ARNs (or AWS managed policy names such as 'ReadOnlyAccess') that further limit the session's permissions.
- Duration (seconds) (`duration_seconds`, number): How long the result stays valid, 900-129600 seconds. Default 43200 (12 hours). From 900 to 129600.
- Session tags (`tags`, object): Optional tags passed into the session as key/value pairs.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "credentials": {
      "access_key_id": "ASIAIOSFODNN7EXAMPLE",
      "expiration": "2026-09-25T22:00:00Z",
      "secret_access_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
      "session_token": "IQoJb3JpZ2luX2VjEXAMPLETOKEN"
    },
    "federated_user": {
      "arn": "arn:aws:sts::123456789012:federated-user/lodol-user",
      "federated_user_id": "123456789012:lodol-user"
    },
    "session_token_size": null,
    "session_token_utilization": null
  }
}
```

### Get session token

Issue temporary credentials with the connected user's own permissions, optionally MFA-authenticated. The result contains a secret access key and session token: anyone who can see this workflow's run history can use them until they expire.

**Inputs**

- Duration (seconds) (`duration_seconds`, number): How long the result stays valid, 900-129600 seconds. Default 43200 (12 hours). From 900 to 129600.
- MFA device ARN (`mfa_serial_number`, text): Only if MFA is required: the device's ARN (arn:aws:iam::123456789012:mfa/device-name), from IAM > Users > your user > Security credentials.
- MFA code (`mfa_token_code`, text): The 6-digit code the MFA device shows now. Required with the device ARN.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "credentials": {
      "access_key_id": "ASIAIOSFODNN7EXAMPLE",
      "expiration": "2026-09-25T22:00:00Z",
      "secret_access_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
      "session_token": "IQoJb3JpZ2luX2VjEXAMPLETOKEN"
    },
    "session_token_size": null,
    "session_token_utilization": null
  }
}
```

### Get web identity token

Issue a signed JWT that proves this AWS identity to an external service (outbound identity federation). The token is a credential: anyone who can see this workflow's run history can present it until it expires.

**Inputs**

- Audience (`audience`, list, required): 1-10 intended recipients, placed in the token's 'aud' claim, e.g. 'https://api.example.com'.
- Signing algorithm (`signing_algorithm`, text, required): How the token is signed. One of: `RS256` (RS256 (RSA)), `ES384` (ES384 (ECDSA P-384)).
- Duration (seconds) (`duration_seconds`, number): How long the result stays valid, 60-3600 seconds. Default 300. From 60 to 3600.
- Custom claims (`tags`, object): Optional key/value pairs added to the token as claims.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "expiration": "2026-09-25T20:05:00Z",
    "web_identity_token": "eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJ4In0.sig"
  }
}
```