Alibaba Cloud Security Token Service (STS) provides short-term access management for Alibaba Cloud accounts or RAM users.
Features
STS grants temporary access tokens to authorized RAM entities (RAM users, RAM user
groups, or RAM roles). The validity period and access permissions of these temporary
access tokens can be customized as needed. Authorized RAM entities with temporary
STS tokens can access Alibaba Cloud resources by using either of the following methods:
- Call Alibaba Cloud API actions.
- Log on to the Alibaba Cloud console.
Endpoint
The endpoint of STS that is used to call API actions is https://sts.aliyuncs.com.
Commonly used terms
- RAM role
- A virtual RAM user.
- ARN
- The Alibaba Cloud Resource Name (ARN) of a RAM role. Each role has a unique ARN.
Format:
acs:ram::$accountID:role/$roleName - Trusted entity
- The trusted entity that can assume a RAM role. You must specify a trusted entity when you create a RAM role. Only trusted entities can assume roles. The trusted entity can be an Alibaba Cloud account, Alibaba Cloud service, or identity provider (IdP).
- Role assuming
- The method for entity users to obtain security tokens of RAM roles. By calling the AssumeRole action, an entity user can obtain the security token of a role and use the token to access Alibaba Cloud service APIs.