Resource Access Management:FAQ about RAM roles and STS tokens

Why do I get the "You are not authorized..." error when calling AssumeRole?

Calling AssumeRole may return this error:

Error message: You are not authorized to do this action. You should be authorized by RAM.

Possible causes:

• You are calling the operation as the Alibaba Cloud account.

  AssumeRole cannot be called by an Alibaba Cloud account. Use a RAM user or role instead.

• The calling identity does not have permissions to assume the role.

  Attach the AliyunSTSAssumeRoleAccess policy or a custom policy to the calling identity. The custom policy must allow the sts:AssumeRole action, as shown in the Policy example below.

• The role's trust policy does not include the calling identity as a principal.

  Update the trust policy of the target role to allow the calling identity to assume it. For more information, see Modify the trust policy for a RAM role.

Who can call the AssumeRole API operation?

Only RAM users or roles can call AssumeRole to obtain temporary security credentials for a RAM role. Alibaba Cloud accounts cannot call this operation.

What types of RAM roles are there and who can assume them?

RAM provides the following role types based on the principal:

How do I restrict a specific RAM user from assuming a specific RAM role?

1. Update the RAM role's trust policy.

   In the trust policy of the RAM role, use the Principal element to specify the RAM user that is allowed to assume the role. In the policy, replace <account-id> with the ID of your Alibaba Cloud account, and <user-name> with the name of the RAM user. For more information, see Modify the trust policy for a RAM role.

   Policy example:

   {
       "Statement": [
           {
               "Action": "sts:AssumeRole",
               "Effect": "Allow",
               "Principal": {
                   "RAM": [
                       "acs:ram::<account-id>:user/<user-name>"
                   ]
               }
           }
       ],
       "Version": "1"
   }

2. Grant the RAM user permission to assume the role.

   Attach the AliyunSTSAssumeRoleAccess policy or a custom policy to the RAM user. A custom policy allows you to restrict which roles the user can assume.

   In the custom policy, use the Resource element to specify the ARN of the RAM role that can be assumed. In the policy, replace <account-id> with the ID of your Alibaba Cloud account, and <role-name> with the name of the RAM role. For more information, see Create a custom policy and Manage RAM user permissions.

   Policy example:

   {
       "Statement": [
           {
               "Action": "sts:AssumeRole",
               "Effect": "Allow",
               "Resource": "acs:ram:*:<account-id>:role/<role-name>"
           }
       ],
       "Version": "1"
   }

How do I view the ARN of a RAM role?

1. Log on to the RAM console.

2. In the left-side navigation pane, choose Identities > Roles.

3. Click the name of the target RAM role.

4. In the Basic Information section, find and copy the role's ARN.

Are there API request limits for STS?

AssumeRole is throttled at 100 requests per second per Alibaba Cloud account (shared across all RAM users and roles).

If you exceed this limit, STS returns one of the following error messages:

• Error messages

  Error code	Error message
  Throttling.Api	Request was denied due to api flow control.
  Throttling.User	Request was denied due to user flow control.
  Throttling	Request was denied due to flow control.

• A 302 status code

To resolve these errors, reduce your request rate. To request a higher quota, submit a ticket.

What are the permission limits of an STS token?

The permissions of an STS token are the intersection of the role's identity-based policies and the session policy that you pass in the Policy parameter of the AssumeRole call.

How long is an STS token valid?

STS tokens default to 3,600 seconds (1 hour). Valid range: 900 seconds (15 minutes) to the role's maximum session duration.

Are multiple STS tokens for the same role valid simultaneously?

Yes. Each token remains valid until expiration. Creating a new token does not invalidate existing ones.

What do I do if an STS token is leaked?

If an STS token is compromised, invalidate all active tokens for that role by removing its permissions or deleting the role:

1. Log on to the RAM console.

2. Detach all policies from the RAM role.

   For more information, see Revoke permissions from a RAM role.

3. Or, delete the RAM role entirely.

   For more information, see Delete a RAM role.

   This action immediately invalidates all unexpired STS tokens for that role.

To resume using the role afterward, create a new role with the same name and policies.

Is there a maximum length for an STS token?

No. Token length is variable. Do not assume a maximum length in your code.