Docs

Torch Log Service

permission management

Access TLS via STS

You can use the Security Token Service (STS) to request temporary security tokens, allowing specified IAM users to access TLS resources within their assigned permissions for a specified period. This topic describes how to use temporary credentials issued by STS to access TLS.

Background information

STS is a temporary access permission management service provided by Volcano Engine, primarily used to grant third-party temporary access to cloud services. For example, when uploading log data directly to TLS using the SDK, for security reasons, it is not recommended to store the Volcano Engine account or IAM user access keys in client code. At this point, you can use STS on your application's server to obtain a temporary security token and issue it to the client. This enables you to create customizable, time-bound, and permission-scoped temporary credentials for third-party self-built applications or IAM users.

Compared to using Volcano Engine access keys, temporary security tokens offer the following advantages:

Using temporary security tokens reduces the risk of Volcano Engine access keys being leaked.

Temporary security tokens allow you to set custom validity periods and expire automatically when the period ends.

You can bind temporary security tokens to custom permission policies for more granular management, restricting the scope of permissions for token holders.

Steps

1 Create an IAM role and grant TLS permissions

An IAM role is a virtual user and does not have permanent credentials. It can only obtain customizable, temporary security tokens through STS, and must be assumed by a trusted entity. In this example, you need to create an IAM role and authorize it, specifying the TLS resource permissions the IAM role will have when assumed by the IAM user.

In the left navigation bar, click Role Management.

On the Role management page, click Create New Role.

In the Create New Role panel, set Select trust identity type to Account, set Select identity to The current account, and then click Next.

Tip

When creating an IAM role, you can only set your own account as the authorized account. In 3 Grant IAM users permission to assume IAM roles., change the authorized account to the specified IAM user, so the IAM user can later assume this role.

Set the role name and then click Next.

Select the TLSReadOnlyAccess policy, and then click Submit.

This example demonstrates how to grant the system default permission TLSReadOnlyAccess to an IAM role. After authorization, this IAM role has read-only access to all TLS resources and pages. You can also create custom permission policies based on your business requirements. For detailed steps, see Create custom policy. For information about available operations and resource authorization, see Authorized actions and Authorizable resources.

Notice

To follow the principle of least privilege, set IAM role permissions carefully. For passwordless login and embedded console scenarios, we recommend granting only read permissions for specific projects or topics, without any change permissions.

Save the TRN for the IAM role.

On the Role management page, click the name of the IAM role you created.

On the Role details page, obtain the role's Role TRN.

When calling the AssumeRole API, enter the TRN.

2. Create an IAM user

An IAM user is an entity identity with a unique ID and credentials, an independent login password, and access keys. You need to create an IAM user to assume IAM roles and facilitate obtaining temporary security tokens. This guide uses Create by username as an example. For other methods, see Create user.

Notice

We recommend using IAM users to access and authenticate TLS in routine operations and data resource management, to reduce the risk of Volcano Engine account key leaks.

In the left navigation bar, select User management > users.

On the Users page, click New user.

On the Create user page, click Create by username.

Set the username, enable programmatic access in access method, and then click Next.

In the Permission settings step, click Next.

In the Review step, confirm the username information, click Next, and follow the on-screen instructions to complete creation.

3 Grant IAM users permission to assume IAM roles.

Once authorized, IAM users can assume IAM roles to obtain temporary security tokens and access TLS resources within the IAM role's permission scope.

The authorization process consists of the following two required settings.

Set the trust policy for the IAM role.

When you create an IAM role, the default trusted entity is the Volcano Engine account. You need to modify the IAM role's trust policy and change the account configured under Principal to the IAM user you created in 2. Create an IAM user, allowing the specified IAM user to assume this IAM role.

Grant the IAM user the STSAssumeRoleAccess permission policy.

You need to grant the STSAssumeRoleAccess permission policy to IAM users before you can use their access keys to call the AssumeRole API and request temporary security tokens.

The steps for authorization are as follows:

Edit the trust policy of the IAM role.

In the left navigation bar, click Role Management.

On the Role Management page, find and click the role you created in 1 Create an IAM role and grant TLS permissions.

On the Role detail page, click Trust relationship.

On the Trust relationship tab, click Edit trust policy.

Edit the IAM field in the trust policy, and then click Save.

Replace the default root value in trn with user/${IAMUserName}, for example, user/TLSUser. For example, the following trust policy allows this IAM role to be assumed by the IAM user TLSUser under the Volcano Engine account 21000****.

{
"Statement": [
{
"Effect": "Allow",
"Action": [
"sts:AssumeRole"
],
"Principal": {
"IAM": [
"trn:iam::21000****:user/TLSUser"
]
}
}
]
}

Grant the IAM user STSAssumeRoleAccess permission.

In the left navigation bar, select User management > users.

On the User page, find and click the user you created in 2. Create an IAM user.

On the User details page, select Permissions > Attach permissions directly, and then click Add permission.

In the Add permission panel, select the STSAssumeRoleAccess policy, and click Submit.

4 Call AssumeRole to obtain a temporary security token

The IAM user calls the AssumeRole API of STS by assuming the IAM role to obtain a temporary security token for the IAM role. The temporary security token includes a temporary access key (AccessKeyId and SecretAccessKey) and a temporary token (SessionToken).

The following is a sample request, where the RoleTrn parameter should be specified as the TRN of the IAM role you created in 1 Create an IAM role and grant TLS permissions

The following is a sample response of the AssumeRole API:

5 Use temporary security tokens to access TLS

After obtaining a temporary security token, you can use it for SDK authentication, and then access TLS through the SDK. For the TLS SDK and related sample code, see SDK list. For example, you can refer to the following Python SDK sample to create a project, create a log topic, configure indexes, write logs, consume logs, and query logs.

Tip

The default validity period of temporary security tokens is one hour. You need to update the token promptly after it expires.

You can use the DurationSeconds parameter in AssumeRole to set the validity period of the temporary security token. The unit for the DurationSeconds parameter is seconds, and it can be set for up to 12 hours.

Last updated: 2026.09.01 17:38:32