Using AWS Security Token Service on a Snowball Edge

The AWS Security Token Service (AWS STS) helps you request temporary, limited-privilege credentials for IAM users.

Using the AWS CLI and API operations on a Snowball Edge

When using the AWS CLI or API operations to issue IAM, AWS STS, Amazon S3, and Amazon EC2 commands on Snowball Edge device, you must specify the region as "snow." You can do this using AWS configure or within the command itself, as in the following examples.

aws configure --profile snowballEdge
AWS Access Key ID [None]: defgh
AWS Secret Access Key [None]: 1234567
Default region name [None]: snow
Default output format [None]: json       

Or

aws iam list-users --endpoint http://192.0.2.0:6078 --region snow --profile snowballEdge

Supported AWS STSAWS CLI commands on a Snowball Edge

Only the assume-role command is supported locally.

The following parameters are supported for assume-role:

Example command to assume a role on a Snowball Edge

To assume a role, use the following command.

    aws sts assume-role --role-arn "arn:aws:iam::123456789012:role/example-role" --role-session-name AWSCLI-Session  --endpoint http://snow-device-IP-address:7078
     

For more information about using the assume-role command, see How do I assume an IAM role using the AWS CLI?

For more information about using AWS STS, see Using Temporary Security Credentials in the IAM User Guide.

Supported AWS STS API operations on a Snowball Edge

Only the AssumeRole API is supported locally.

The following parameters are supported for AssumeRole:

https://sts.amazonaws.com/
?Version=2011-06-15
&Action=AssumeRole
&RoleSessionName=session-example
&RoleArn=arn:aws:iam::123456789012:role/demo
&DurationSeconds=3600