Docs

IAM

STS

AssumeRoleWithOIDC

Acts to obtain temporary security credentials based on OIDC federated authentication.

request description

The interface request does not need to be signed, it is recommended to use the POST method call, the request header Content-Type is set to application/x-www-form-urlencoded, and the parameters are encoded by the URL and submitted in the form of the request body.
Request address: https://sts.volcengineapi.com
Limited viewership of 200/s per account

request parameters

Parameters	Type	Required or not	Example Values	Description
RoleTrn	String	Yes	trn:iam::2000012345:role/my_role	The role Trn to be played is in the format of'trn: iam:: ${AccountId}: role/${RoleName} '. Where' ${AccountId} 'needs to fill in the main account ID to which the role belongs, and' ${RoleName} 'needs to fill in the actual role name. For example, the RoleTrn corresponding to the role named myRole in the account with the account ID of 2000012345 is'trn: iam :: 2000012345: role/myRole `
OIDCToken	String	Yes	eyJraWQiOiJKQzl3eHpyaHFKMGd0****	OIDC Token issued by an external IdP. nLength: 4~ 65536 characters.
Policy	String	No	{"Statement":[{"Effect":"Allow","Action":["iam:GetUser"],"Resource":["*"]}]}	Role internal connection policy to further restrict the permissions of temporary credentials. The length should not exceed 2048 characters. If the internal connection permissions policy is not null, the actual permissions of the temporary credentials are the intersection of the permissions policy of the role played and the internal connection permissions policy. The policy syntax format is the same as that of a normal IAM policy, see Introduction to Policy Syntax (https://www.volcengine.com/docs/6257/65059).
DurationSeconds	Integer	No	3600	Temporary key valid duration (unit: seconds), the shortest can be set to 900 seconds, and the longest can be set to the maximum session duration value of the role (configured in the role information), the default value is 3600 seconds.
RoleSessionName	String	Yes	Bob	Role session name, length 2-64 characters, supports English, numbers and. - _ @symbols. For the same role, a different session name can be specified each time it is played, thus achieving the purpose of distinguishing sessions. This field is also reflected in Cloud Audit (https://www.volcengine.com/docs/7015/166040) to make it easier to distinguish access records for different sessions from the audit log.

return parameters

Parameters	Type	Example Values	Description
Credentials	Object	Please refer to the specific parameter example value in the data structure.	Temporary security credentials generated by role play.
OIDCTokenInfo	Object	Please refer to the specific parameter example value in the data structure	OIDC Token information.
AssumedRoleUser	Object	Please refer to the specific parameter example value in the data structure. n n	Basic information about role-playing.

Request example

POST /?Action=AssumeRoleWithOIDC&Version=2018-01-01 HTTP/1.1 
Host: sts.volcengineapi.com 
Content-Type: application/x-www-form-urlencoded 
User-Agent: curl/7.64.1 

RoleTrn=trn%3Aiam%3A%3A2000012345%3Arole%2Fmy_role&OIDCToken=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.example&Policy=%7B%22Statement%22%3A%5B%7B%22Effect%22%3A%22Allow%22%2C%22Action%22%3A%5B%22%2A%22%5D%2C%22Resource%22%3A%5B%22%2A%22%5D%7D%5D%7D&DurationSeconds=3600&RoleSessionName=Bob

Back to example

{ 
  "ResponseMetadata": { 
    "RequestId": "202503172004180982021380116A5E29", 
    "Action": "AssumeRoleWithOIDC", 
    "Version": "2018-01-01", 
    "Service": "sts", 
    "Region": "cn-beijing" 
  }, 
  "Result": { 
    "Credentials": { 
      "CurrentTime": "2021-04-12T10:57:09+08:00\n\n", 
      "Expiration": "2021-04-12T11:57:09+08:00\n\n", 
      "AccessKeyId": "AKTPODg0MzV**2ZDcxMDg\n\n", 
      "SecretAccessKey": "TVRNNVlqRmxPR1**mRoTkdWbE1ESQ==\n\n", 
      "SessionToken": "STSeyJBY2NvdW50SW******...W50a" 
    }, 
    "OIDCTokenInfo": { 
      "Subject": "KryrkIdjylZb7agUgCEf****", 
      "Issuer": "https://dev-xxxxxx.****.com", 
      "ClientIds": [ 
        "496271242565057****" 
      ], 
      "ExpirationTime": "2021-10-20T04:27:09Z", 
      "IssuanceTime": "2021-10-20T03:27:09Z" 
    }, 
    "AssumedRoleUser": { 
      "AssumedRoleId": "5DokUfQQs", 
      "Trn": "vJ" 
    } 
  } 
}

error code


400	InvalidOIDCToken	Invalid OIDC Token format	OIDC Token is invalid.
400	RoleNotExist	Role '{{.Role}}' does not exist.	The role to be played does not exist.
400	InvalidParameter	The parameter '{{.Name}}' is invalid.	Invalid call parameter exists.

Last updated: 2025.10.10 11:26:15

IAM

request description #

request parameters #

return parameters #

Request example #