Using AWS Security Token Service on a Snow Family device
The AWS Security Token Service (AWS STS) helps you request temporary, limited-privilege credentials for IAM users.
Important
For AWS services to work properly on a Snowball Edge, you must allow the ports for the services. For details, see Port requirements for AWS services on a Snow Family device.
Topics
Using the AWS CLI and API operations on a Snow Family device
When using the AWS CLI or API operations to issue IAM, AWS STS, Amazon S3, and Amazon EC2 commands
on Snowball Edge device, you must specify the region
as "snow
." You
can do this using AWS configure
or within the command itself, as in the
following examples.
aws configure --profile snowballEdge AWS Access Key ID [None]: defgh AWS Secret Access Key [None]: 1234567 Default region name [None]: snow Default output format [None]: json
Or
aws iam list-users --profile snowballEdge --endpoint http://192.0.2.0:6078 --region snow
Note
The access key ID and access secret key that are use locally on AWS Snowball Edge can't be interchanged with the keys in the AWS Cloud.
Supported AWS STSAWS CLI commands on a Snow Family device
Only the assume-role command is supported locally.
The following parameters are supported for assume-role
:
role-arn
role-session-name
duration-seconds
Example command to assume a role on a Snow Family device
To assume a role, use the following command.
aws sts assume-role --role-arn
"arn:aws:iam::123456789012:role/example-role"
--role-session-nameAWSCLI-Session
--endpointhttp://snow-device-IP-address
:7078
For more information about using the assume-role
command, see
How do I assume an
IAM role using the AWS CLI?
For more information about using AWS STS, see Using Temporary Security Credentials in the IAM User Guide.
Supported AWS STS API operations on a Snow Family device
Only the AssumeRole API is supported locally.
The following parameters are supported for AssumeRole
:
RoleArn
RoleSessionName
DurationSeconds
Example of assuming a role
https://sts.amazonaws.com/ ?Version=2011-06-15 &Action=AssumeRole &RoleSessionName=session-example &RoleArn=arn:aws:iam::123456789012:role/demo &DurationSeconds=3600