CODEWITHSUNDEEP
amazon-web-servicespostmanaws-sts
snowcoder
snowcoder

Reputation: 491

AWS STS Assume Role: Get session token

I am trying to get a session token for the given IAM in postman but not able to receive a token.

If I use boto3.client('sts'), I am able to get the token.

Use Case: I am trying to Invoke VPC Rest Endpoint from EC2 instance where ServiceNow mid-server instance is running. Since we have ServiceNow mid-server agent running on EC2 instance, I want to use IAM Role attached to EC2 to authenticate other VPC endpoints that are deployed in the same AWS account.

I have permission policy attached to IAM Role to allow Assume Role policy. If there any other approach, please suggest.

here HTML HTML response in postman. Postman redirecting to IAM Docs

enter image description here

client = boto3.client('sts')
response = client.assume_role(
    RoleArn='arn:aws:iam::**************:role/ServiceNow-midserver-Role',
    RoleSessionName='Session1',
    DurationSeconds=3600
    )
print(response)

anything wrong with postman request body or endpoint. Authentication on postman is none.

enter image description here

Upvotes: 1

Views: 10347

Answers (2)

jarmod
jarmod

Reputation: 78653

To call AssumeRole from Postman (or curl etc.) as opposed to using a supported AWS SDK, you should follow the AssumeRole API documentation. You will also need to authenticate using AWS credentials.

Specifically, the request is an HTTP GET and parameters are passed as query strings, for example:

GET https://sts.amazonaws.com/
?Version=2011-06-15
&Action=AssumeRole
&RoleSessionName=stackoverflow-64706420
&RoleArn=arn:aws:iam::123456781234:role/myrole
&DurationSeconds=3600

Here's what this looks like in Postman:

enter image description here

And you will need to add AWS credentials so that your API request is signed correctly, for example:

enter image description here

Click 'Send' and the response will look something like this:

<AssumeRoleResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
  <AssumeRoleResult>
    <AssumedRoleUser>
      <Arn>arn:aws:sts::123456781234:assumed-role/123456781234/stackoverflow-64706420</Arn>
      <AssumedRoleId>ARO123EXAMPLE123:stackoverflow-64706420</AssumedRoleId>
    </AssumedRoleUser>
    <Credentials>
      <AccessKeyId>ASIAIOSFODNN7EXAMPLE</AccessKeyId>
      <SecretAccessKey>wJalrXUtnFEMI/K7MDENG/bPxRfiCYzEXAMPLEKEY</SecretAccessKey>
      <SessionToken>
       AQoDYXdzEPT//////////wEXAMPLEtc764bNrC9SAPBSM22wDOk4x4HIZ8j4FZTwdQW
       LWsKWHGBuFqwAeMicRXmxfpSPfIeoIYRqTflfKD8YUuwthAx7mSEI/qkPpKPi/kMcGd
       QrmGdeehM4IC1NtBmUpp2wUE8phUZampKsburEDy0KPkyQDYwT7WZ0wq5VSXDvp75YU
       9HFvlRd8Tx6q6fE8YQcHNVXAkiY9q6d+xo0rKwT38xVqr7ZD0u0iPPkUL64lIZbqBAz
       +scqKmlzm8FDrypNC9Yjc8fPOLn9FX9KSYvKTr4rvx3iSIlTJabIQwj2ICCR/oLxBA==
      </SessionToken>
      <Expiration>2020-12-09T13:34:41Z</Expiration>
    </Credentials>
    <PackedPolicySize>6</PackedPolicySize>
  </AssumeRoleResult>
  <ResponseMetadata>
    <RequestId>c6104cbe-af31-11e0-8154-cbc7ccf896c7</RequestId>
  </ResponseMetadata>
</AssumeRoleResponse>

Upvotes: 3

JayeshCP
JayeshCP

Reputation: 1

You need to use credentials for an IAM user or an IAM role to call AssumeRole. boto3 must be getting credentials from the standard locations it look for (like ~/.aws/config) [ref:https://boto3.amazonaws.com/v1/documentation/api/latest/guide/configuration.html]. May be you could try providing the AWS creds in Authorization tab in Postman selecting type as AWS Signature and then call assumeRole.

Upvotes: 0

Related Questions