Buckit Object Storage User Guide

`AssumeRole`

The Buckit Security Token Service (STS) AssumeRole API endpoint generates temporary credentials for an existing built-in Buckit user. Applications can use the returned credentials instead of distributing long-lived access keys.

This endpoint requires AWS Signature Version 4 authentication with the built-in user’s access key and secret key. Temporary credentials and service accounts cannot call AssumeRole to mint additional temporary credentials.

The Buckit STS AssumeRole API endpoint is modeled after the AWS AssumeRole endpoint and shares certain request and response elements.

Request Endpoint

The AssumeRole endpoint has the following form:

POST https://buckit.example.net?Action=AssumeRole[&ARGS]

Replace buckit.example.net with the appropriate URL for your Buckit deployment. Sign the request with the built-in user’s access key and secret key using SigV4.

Request Query Parameters

This endpoint supports the following query parameters:

Parameter	Type	Description
`Version`	string	Required Specify `2011-06-15`.
`DurationSeconds`	integer	Optional Specify the number of seconds after which the temporary credentials expire. Defaults to `3600`. The minimum value is `900` or 15 minutes. The maximum value is `31536000` or 365 days.
`Policy`	string	Optional Specify the URL-encoded JSON-formatted policy to use as an inline session policy. The minimum string length is `1`. The maximum string length is `2048`. The resulting permissions are the intersection between the built-in user’s existing permissions and the inline session policy.

Parameter

Type

Description

Version

string

Required

Specify 2011-06-15.

DurationSeconds

integer

Optional

Specify the number of seconds after which the temporary credentials expire. Defaults to 3600.

The minimum value is 900 or 15 minutes.
The maximum value is 31536000 or 365 days.

Policy

string

Optional

Specify the URL-encoded JSON-formatted policy to use as an inline session policy.

The minimum string length is 1.
The maximum string length is 2048.

The resulting permissions are the intersection between the built-in user’s existing permissions and the inline session policy.

Response Elements

The XML response for this API endpoint is similar to the AWS AssumeRole response. Specifically, Buckit returns an AssumeRoleResult object, where the Credentials object contains the temporary credentials generated by Buckit:

AccessKeyId - The access key applications use for authentication.
SecretAccessKey - The secret key applications use for authentication.
Expiration - The RFC3339 date and time after which the credentials expire.
SessionToken - The session token applications use for authentication.

Error Elements

The XML error response for this API endpoint is similar to the AWS AssumeRole errors.