mirror of https://github.com/hanzoai/s3.git synced 2026-11-03 03:07:41 +00:00

Files

T

zeekay 6b0f2d88ff Rebrand docs, helm, and user-facing strings: MinIO→S3, min.io→hanzo.ai

- Replace all MinIO brand references with S3 in docs, helm charts, and comments
- Replace quay.io/minio images with ghcr.io/hanzoai/s3 and ghcr.io/hanzos3/*
- Replace min.io domains: docs→docs.hanzo.ai, dl→dl.hanzo.space, play→play.hanzo.space
- Replace slack.min.io with hanzo.ai/discord
- Replace subnet.min.io with subnet.hanzo.ai
- Update Makefile REPO to ghcr.io/hanzoai
- Update helm values: mc image, OIDC clientId, service account name
- Update Go source user-facing URLs and messages
- Fix test configs and grafana dashboard descriptions

2026-02-23 17:28:20 -08:00

3.0 KiB

Raw Permalink Blame History

AssumeRoleWithCustomToken

Introduction

To integrate with custom authentication methods using the Identity Management Plugin), S3 provides an STS API extension called AssumeRoleWithCustomToken.

After configuring the plugin, use the generated Role ARN with AssumeRoleWithCustomToken to get temporary credentials to access object storage.

API Request

To make an STS API request with this method, send a POST request to the S3 endpoint with following query parameters:

Parameter	Type	Required
Action	String	Yes	Value must be `AssumeRoleWithCustomToken`
Version	String	Yes	Value must be `2011-06-15`
Token	String	Yes	Token to be authenticated by identity plugin
RoleArn	String	Yes	Must match the Role ARN generated for the identity plugin
DurationSeconds	Integer	No	Duration of validity of generated credentials. Must be at least 900.

The validity duration of the generated STS credentials is the minimum of the DurationSeconds parameter (if passed) and the validity duration returned by the Identity Management Plugin.

API Response

XML response for this API is similar to AWS STS AssumeRoleWithWebIdentity

Example request and response

Sample request with curl:

curl -XPOST 'http://localhost:9001/?Action=AssumeRoleWithCustomToken&Version=2011-06-15&Token=aaa&RoleArn=arn:minio:iam:::role/idmp-vGxBdLkOc8mQPU1-UQbBh-yWWVQ'

Prettified Response:

<?xml version="1.0" encoding="UTF-8"?>
<AssumeRoleWithCustomTokenResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
  <AssumeRoleWithCustomTokenResult>
    <Credentials>
      <AccessKeyId>24Y5H9VHE14H47GEOKCX</AccessKeyId>
      <SecretAccessKey>H+aBfQ9B1AeWWb++84hvp4tlFBo9aP+hUTdLFIeg</SecretAccessKey>
      <Expiration>2022-05-25T19:56:34Z</Expiration>
      <SessionToken>eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJhY2Nlc3NLZXkiOiIyNFk1SDlWSEUxNEg0N0dFT0tDWCIsImV4cCI6MTY1MzUwODU5NCwiZ3JvdXBzIjpbImRhdGEtc2NpZW5jZSJdLCJwYXJlbnQiOiJjdXN0b206QWxpY2UiLCJyb2xlQXJuIjoiYXJuOm1pbmlvOmlhbTo6OnJvbGUvaWRtcC14eHgiLCJzdWIiOiJjdXN0b206QWxpY2UifQ.1tO1LmlUNXiy-wl-ZbkJLWTpaPlhaGqHehsi21lNAmAGCImHHsPb-GA4lRq6GkvHAODN5ZYCf_S-OwpOOdxFwA</SessionToken>
    </Credentials>
    <AssumedUser>custom:Alice</AssumedUser>
  </AssumeRoleWithCustomTokenResult>
  <ResponseMetadata>
    <RequestId>16F26E081E36DE63</RequestId>
  </ResponseMetadata>
</AssumeRoleWithCustomTokenResponse>

3.0 KiB Raw Permalink Blame History