AWS STS component

The aws2-sts component gets temporary AWS credentials (assume role, session and federation tokens) and tells which identity the credentials belong to.

Scheme: aws2-sts: · Crate: cameleer-cloud · Cargo feature: cloud · Consumer: no · Producer: yes · Apache Camel: AWS Security Token Service (STS)

When to use it

Check at startup which account and role an integration runs as (getCallerIdentity).
Assume a role in another account and use the temporary credentials for other AWS endpoints.
Issue short-lived federation tokens for clients.

URI format

text

aws2-sts://label[?options]

Example

Log the identity of the integration when it starts:

yaml example: aws2-sts-caller-identity

- route:
    id: who-am-i
    from:
      uri: "timer:whoami?repeatCount=1"
      steps:
        - to: "aws2-sts://sts?region={{env:AWS_REGION:us-east-1}}&operation=getCallerIdentity"
        - log: "running as ${body[arn]} in account ${body[account]}"
        - to: "log:identity"

Rust DSL

rust

ctx.add_routes(|b| {
    b.from("timer:whoami?repeatCount=1")
        .to("aws2-sts://sts?region={{env:AWS_REGION:us-east-1}}&operation=getCallerIdentity")
        .log("running as ${body[arn]} in account ${body[account]}")
        .to("log:identity");
})?;

Options

Common AWS options (region, credentials, endpoint override, proxy) are listed in Cloud credentials.

option	default	description
`operation`	`assumeRole`	`assumeRole`, `getSessionToken`, `getFederationToken`, `getCallerIdentity`.

The credential operations return the map {accessKeyId, secretAccessKey, sessionToken, expiration} (plus assumedRoleArn or federatedUserArn), ready to be used as the accessKey, secretKey and sessionToken options of other AWS endpoints. getCallerIdentity returns the identity map.

Message headers

header	direction	description
`CamelAwsStsOperation`	in	Overrides `operation`.
`CamelAwsStsRoleArn`, `CamelAwsStsRoleSessionName`	in	Role of `assumeRole`.
`CamelAwsStsDurationSeconds`	in	Lifetime of the credentials.
`CamelAwsStsFederatedName`, `CamelAwsStsPolicy`	in	`getFederationToken`.

Run it with Docker

docker run --rm -e AWS_REGION -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY \
  -v "$PWD:/routes:ro" pmsudhi/cameleer run /routes/whoami.camel.yaml

Common questions

Do I need this component to use IAM roles?

No. Instance roles, ECS task roles and EKS web identity (IRSA) are picked up by the default credentials chain of every AWS component; see Cloud credentials.

Found a problem?

If something on this page doesn't match what Cameleer does, or you hit a bug while building with it, please help fix it, whether you are a person or a coding agent: open an issue that describes what you saw, then fork the repository, fix it, add or update a test, run cargo test --workspace, and open a pull request. CONTRIBUTING.md explains the ground rules.