Using AWS Security Token Service - AWS Snowball Edge Developer Guide
Using the AWS CLI and API Operations on Snowball EdgeSupported AWS STSAWS CLI Commands on a Snowball EdgeSupported AWS STS API Operations

Using AWS Security Token Service

The AWS Security Token Service (AWS STS) helps you request temporary, limited-privilege credentials for IAM users.

Important

For AWS services to work properly on a Snowball Edge, you must allow the ports for the services. For details, see Ports Required to Use AWS Services on an AWS Snowball Edge Device.

Using the AWS CLI and API Operations on Snowball Edge

When using the AWS CLI or API operations to issue IAM, AWS STS, Amazon S3, and Amazon EC2 commands on Snowball Edge device, you must specify the region as "snow." You can do this using AWS configure or within the command itself, as in the following examples.

aws configure --profile snowballEdge
AWS Access Key ID [None]: defgh
AWS Secret Access Key [None]: 1234567
Default region name [None]: snow
Default output format [None]: json

Or

aws iam list-users --profile snowballEdge --endpoint http://192.0.2.0:6078 --region snow
Note

The access key ID and access secret key that are use locally on AWS Snowball Edge can't be interchanged with the keys in the AWS Cloud.

Supported AWS STSAWS CLI Commands on a Snowball Edge

Only the assume-role command is supported locally.

The following parameters are supported for assume-role:

  • role-arn

  • role-session-name

  • duration-seconds

Example Command

To assume a role, use the following command.


    aws sts assume-role --role-arn "arn:aws:iam::123456789012:role/example-role" --role-session-name AWSCLI-Session  --endpoint http://snow-device-IP-address:7078

For more information about using the assume-role command, see How do I assume an IAM role using the AWS CLI?

For more information about using AWS STS, see Using Temporary Security Credentials in the IAM User Guide.

Supported AWS STS API Operations

Only the AssumeRole API is supported locally.

The following parameters are supported for AssumeRole:

  • RoleArn

  • RoleSessionName

  • DurationSeconds

Example

To assume a role, use the following.

https://sts.amazonaws.com/
?Version=2011-06-15
&Action=AssumeRole
&RoleSessionName=session-example
&RoleArn=arn:aws:iam::123456789012:role/demo
&DurationSeconds=3600