Generating role-scoped STS credentials Using AssumeRole

Learn how to request short-term AWS Security Token Service (STS) credentials using the full, unrestricted permissions of a target role (without inline session policy constraints). It also details how to apply these temporary credentials in a client environment and verify that the expected role-level permissions are active.

Open a terminal on your device.
To obtain role-scoped STS credentials, run the following assume-role command in the Cloudera Manager Host 1 where you configured AWS:
note
This is the same server used in Creating an Ozone bucket and installing AWS CLI.
```
aws sts assume-role \
  --role-arn arn:aws:iam::[***ACCOUNT_ID***]:role/[***ROLE_NAME***] \
  --role-session-name "[***SESSION_NAME***]" \
  --duration-seconds 3600 \
  --endpoint-url "https://[***OZONE_HOST***]:[***OZONE_PORT***]"
```
where,
- [***ACCOUNT_ID***] is a dummy ID that must match the valid length of an AWS account ID.
- [***ROLE_NAME***] must be the same role that was created in Ranger.
- [***SESSION_NAME***] is a dummy name that must match the valid length as per AWS specifications.
Example,
```
aws sts assume-role \
  --role-arn "arn:aws:iam::123456789012:role/iceberg-data-all-access" \
  --role-session-name "iceberg-session-no-policy" \
  --duration-seconds 3600 \
  --endpoint-url "https://ozone-host.example.com:9881"
```
The command returns a JSON object containing the temporary STS credentials:
- AccessKeyId
- SecretAccessKey
- SessionToken
Record these temporary STS credentials.
Open a new terminal and connect to the new cluster server using SSH:
note
This server must be different from the one used in Creating an Ozone bucket and installing AWS CLI.
```
ssh root@[***CLOUDERA_MANAGER_HOST_NAME***]
```
Example,
```
ssh root@cm_hostname_2.example.com
```
When prompted, enter the password.

Download and install the AWS CLI (if not already installed):

curl https://awscli.amazonaws.com/[***AWS_PACKAGE_NAME***] -o awscliv2.zip
unzip awscliv2.zip
sudo ./aws/install

Example for a Linux server:

curl https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip -o awscliv2.zip
unzip awscliv2.zip
sudo ./aws/install

Configure the AWS client to use the STS credentials that were generated in the step 2 in the previous cluster server:
```
CREDS='[***PASTE_THE_JSON_RESPONSE_COPIED_IN_STEP_2_WHILE_INVOKING_ASSUMEROLE_API***]'
```

Parse the credentials and export the environment variables along with your S3 endpoint URL:

export AWS_ACCESS_KEY_ID=$(echo "$CREDS" | jq -r .Credentials.AccessKeyId)
export AWS_SECRET_ACCESS_KEY=$(echo "$CREDS" | jq -r .Credentials.SecretAccessKey)
export AWS_SESSION_TOKEN=$(echo "$CREDS" | jq -r .Credentials.SessionToken)
export AWS_ENDPOINT_URL_S3=https://[***OZONE_SSL_S3_GATEWAY_HOST***]:[***OZONE_PORT***]

Example,

export AWS_ACCESS_KEY_ID=$(echo "$CREDS" | jq -r .Credentials.AccessKeyId)
export AWS_SECRET_ACCESS_KEY=$(echo "$CREDS" | jq -r .Credentials.SecretAccessKey)
export AWS_SESSION_TOKEN=$(echo "$CREDS" | jq -r .Credentials.SessionToken)
export AWS_ENDPOINT_URL_S3="https://ozone-ssl-s3-gateway-host.example.com:9879"

Attempt to create a bucket and this command must fail due to limited permissions:
note
This command should fail because the assumed role only grants GetObject and PutObject actions, neither of which permits bucket creation.
```
aws s3api create-bucket --bucket [***TEST_BUCKET_NAME***] --region [***REGION***]
```
Example,
```
aws s3api create-bucket --bucket my-sts-created-bucket-001 --region us-east-1
```

Retrieve the test object and this command must be executed successfully:

aws s3api get-object --bucket [***BUCKET_NAME***] --key [***OBJECT_KEY***] ./[***TEST-FILE-NAME***]

Example,

aws s3api get-object --bucket iceberg --key demotest.txt ./test.txt

Overwrite the object and this command must be executed successfully:

aws s3api put-object --bucket [***BUCKET_NAME***] --key [***OBJECT_KEY***] --body ./[***TEST-FILE-NAME***]

Example,

aws s3api put-object --bucket iceberg --key demotest.txt --body ./test.txt

Attempt to retrieve the object tags to verify that the command fails due to insufficient permissions:
note
This command should fail because the assumed role only grants GetObject and PutObject actions, neither of which permits retrieving object tags.
```
aws s3api get-object-tagging --bucket [***BUCKET_NAME***] --key [***OBJECT_KEY***]
```
Example,
```
aws s3api get-object-tagging --bucket iceberg --key demotest.txt
```