Skip to content

iam-sts.md

Latest commit

 

History

History
127 lines (100 loc) · 3.34 KB

iam-sts.md

File metadata and controls

127 lines (100 loc) · 3.34 KB
Raw

IAM / STS

Overview

DevCloud IAM and STS share a single SQLite database (WAL mode). IAM manages users, roles, and access keys. STS generates temporary credentials and caller identity information.

Both services use the Query protocol (form-encoded requests, XML responses).

Supported IAM APIs

Operation Description
CreateUser Create an IAM user
ListUsers List all IAM users
CreateRole Create an IAM role with assume role policy document
ListRoles List all IAM roles
AttachRolePolicy Attach a managed policy ARN to a role
CreateAccessKey Generate an access key pair for a user

Supported STS APIs

Operation Description
GetCallerIdentity Return account ID, ARN, and user ID
AssumeRole Generate temporary credentials (ASIA-prefixed keys, 1-hour expiry)
GetSessionToken Generate MFA-backed session credentials

boto3 Examples

IAM: Create users and roles

import boto3

iam = boto3.client(
    "iam",
    endpoint_url="http://localhost:4747",
    aws_access_key_id="test",
    aws_secret_access_key="test",
    region_name="us-east-1",
)

# Create user
iam.create_user(UserName="testuser")

# Create access key for user
keys = iam.create_access_key(UserName="testuser")
print(keys["AccessKey"]["AccessKeyId"])
print(keys["AccessKey"]["SecretAccessKey"])

# Create role
iam.create_role(
    RoleName="lambda-role",
    AssumeRolePolicyDocument='{"Version":"2012-10-17","Statement":[]}',
)

# List users and roles
for user in iam.list_users()["Users"]:
    print(user["UserName"])
for role in iam.list_roles()["Roles"]:
    print(role["RoleName"])

STS: Get caller identity and assume role

sts = boto3.client(
    "sts",
    endpoint_url="http://localhost:4747",
    aws_access_key_id="test",
    aws_secret_access_key="test",
    region_name="us-east-1",
)

# Get caller identity
identity = sts.get_caller_identity()
print(identity["Account"])  # 000000000000
print(identity["Arn"])

# Assume role
response = sts.assume_role(
    RoleArn="arn:aws:iam::000000000000:role/lambda-role",
    RoleSessionName="my-session",
)
creds = response["Credentials"]
print(creds["AccessKeyId"])      # ASIA-prefixed
print(creds["SecretAccessKey"])
print(creds["SessionToken"])
print(creds["Expiration"])       # 1 hour from now

AWS CLI Examples

# Create user
aws --endpoint-url http://localhost:4747 iam create-user --user-name testuser

# Create access key
aws --endpoint-url http://localhost:4747 iam create-access-key --user-name testuser

# Get caller identity
aws --endpoint-url http://localhost:4747 sts get-caller-identity

# Assume role
aws --endpoint-url http://localhost:4747 sts assume-role \
  --role-arn arn:aws:iam::000000000000:role/my-role \
  --role-session-name my-session

Known Limitations

IAM:

  • No GetUser, DeleteUser, UpdateUser
  • No DeleteRole, UpdateRole
  • No inline policies (PutRolePolicy, PutUserPolicy)
  • No groups
  • No MFA device management
  • No login profiles / password management
  • No tagging
  • No policy enforcement — policies are stored but not evaluated

STS:

  • Temporary credentials are generated but not tracked or validated
  • Fixed 1-hour expiration (no custom duration)
  • No external ID validation
  • No policy enforcement on assumed roles
  • Single account model (account ID: 000000000000)