Generating limited-scope STS credentials Using AssumeRole

Learn how to request short-term Ozone S3 Security Token Service (STS) credentials scoped with limited permissions (for example, inline read-only s3:GetObject permissions).

Access to an environment configured with a STS service endpoint and a target Ranger role.

Open a terminal on your device.

note
This is the same server used in Creating an Ozone bucket and installing AWS CLI.

Run the assume-role command with an inline session policy to restrict permissions to read-only (s3:GetObject):

aws sts assume-role \
  --role-arn arn:aws:iam::[***ACCOUNT_ID***]:role/[***ROLE_NAME***] \
  --role-session-name "[***SESSION_NAME***]" \
 --policy '{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": "s3:GetObject",
        "Resource": "arn:aws:s3:::[***BUCKET_NAME***]/*"
      }
    ]
  }' \
  --duration-seconds 3600 \
  --endpoint-url "https://[***OZONE_HOST***]:[***OZONE_PORT***]"

where,

[***ACCOUNT_ID***] is a dummy ID that must match the valid length of an AWS account ID.
[***ROLE_NAME***] must be the same role that was created in Ranger.
[***SESSION_NAME***] is a dummy name that must match the valid length as per AWS specifications.
[***BUCKET_NAME***] must be the bucket name that was created in Ozone and for which corresponding resource policies were created in Ranger.

Example,

aws sts assume-role \
  --role-arn "arn:aws:iam::123456789012:role/iceberg-data-all-access" \
  --role-session-name "iceberg-session-with-policy" \
  --policy '{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": "s3:GetObject",
        "Resource": "arn:aws:s3:::iceberg/*"
      }
    ]
  }' \
  --duration-seconds 3600 \
  --endpoint-url "https://ozone-host.example.com:9881"

The command returns a JSON object containing the temporary STS credentials:

AccessKeyId
SecretAccessKey
SessionToken

Record these temporary STS credentials.

Open a new terminal and SSH into the cluster server :
note
This server must be different from the one used in Creating an Ozone bucket and installing AWS CLI.
```
ssh root@[***CLOUDERA_MANAGER_HOST_NAME***]
```
Example,
```
ssh root@cm_hostname_2.example.com
```
When prompted, enter the password.

Download and install the AWS CLI (if not already installed):

curl https://awscli.amazonaws.com/[***AWS_PACKAGE_NAME***] -o awscliv2.zip
unzip awscliv2.zip
sudo ./aws/install

Example for a Linux server:

curl https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip -o awscliv2.zip
unzip awscliv2.zip
sudo ./aws/install

Configure the AWS client to use the STS credentials that were generated in the step 2 in the previous cluster server:
```
CREDS='[***PASTE_THE_JSON_RESPONSE_COPIED_IN_STEP_2_WHILE_INVOKING_ASSUMEROLE_API***]'
```

Parse the credentials and export the environment variables along with your S3 endpoint URL:

export AWS_ACCESS_KEY_ID=$(echo "$CREDS" | jq -r .Credentials.AccessKeyId)
export AWS_SECRET_ACCESS_KEY=$(echo "$CREDS" | jq -r .Credentials.SecretAccessKey)
export AWS_SESSION_TOKEN=$(echo "$CREDS" | jq -r .Credentials.SessionToken)
export AWS_ENDPOINT_URL_S3=https://[***OZONE_SSL_S3_GATEWAY_HOST***]:[***OZONE_PORT***]

Example,

export AWS_ACCESS_KEY_ID=$(echo "$CREDS" | jq -r .Credentials.AccessKeyId)
export AWS_SECRET_ACCESS_KEY=$(echo "$CREDS" | jq -r .Credentials.SecretAccessKey)
export AWS_SESSION_TOKEN=$(echo "$CREDS" | jq -r .Credentials.SessionToken)
export AWS_ENDPOINT_URL_S3="https://ozone-ssl-s3-gateway-host.example.com:9879"

Attempt to create a bucket to verify that the command fails due to insufficient permissions:
note
This command should fail because GetObject in the session policy does not permit bucket creation.
```
aws s3api create-bucket --bucket [***TEST_BUCKET_NAME***]> --region [***REGION***]
```
Example,
```
aws s3api create-bucket --bucket my-sts-created-bucket-001 --region us-east-1
```

Retrieve the test object and this command will be executed successfully:

aws s3api get-object --bucket [***BUCKET_NAME***] --key [***OBJECT_KEY***] ./[***TEST_FILE_NAME***]

Example,

aws s3api get-object --bucket iceberg --key demotest.txt ./test.txt

Validate the content of the retrieved file:
```
cat ./[***TEST_FILE_NAME***]
```
Example,
```
cat ./test.txt
```
Attempt to overwrite the object to verify that the command fails due to insufficient permissions:
note
This command should fail because GetObject in the session policy does not permit uploading or overwriting objects.
```
aws s3api put-object --bucket [***BUCKET_NAME***] --key [***OBJECT_KEY***] --body ./[***TEST_FILE_NAME***]
```
Example,
```
aws s3api put-object --bucket iceberg --key demotest.txt --body ./test.txt
```
Attempt to retrieve the object tags to verify that the command fails due to insufficient permissions:
note
This command should fail because GetObject in the session policy does not permit retrieving object tags.
```
aws s3api get-object-tagging --bucket [***BUCKET_NAME***] --key [***OBJECT_KEY***]
```
Example,
```
aws s3api get-object-tagging --bucket iceberg --key demotest.txt
```