AssumeRole

Print
Dark
Light

AssumeRole

Print
Dark
Light

Article summary

Did you find this summary helpful?

Thank you for your feedback

Post

/#/AssumeRole

Availability
Early Access: July 1, 2026
Early Access is gated; contact the Backblaze Sales team for access.
Limited Availability: July 1, 2026
This API is available only to customers with access to the Backblaze Enterprise Web Console. For more information, contact the Backblaze Sales team.

Return temporary security credentials for a role session

Actual request: POST / HTTP/1.1 to sts.backblazeb2.com with Action=AssumeRole in the form-encoded body.

Request parameters

Parameter	Type	Required	Description
Action	string	yes	AssumeRole
Version	string	yes	2011-06-15
RoleArn	string	yes	ARN of the role to assume.
RoleSessionName	string	yes	Identifier for the role session.
DurationSeconds	integer	no	Session duration in seconds (900 to 43,200).
Policy	string	no	URL-encoded inline session policy JSON. Maximum 2,048 characters after decoding.
SourceIdentity	string	no	Source identity value for audit and policy evaluation.
Tag.N.Key	string	no	Session tag key. Up to 50 tags per request.
Tag.N.Value	string	no	Session tag value.

Unsupported AWS STS parameters

The following AssumeRole parameters are not supported in this release: ExternalId, SerialNumber, TokenCode, PolicyArns.member.N, ProvidedContexts.member.N, TransitiveTagKeys.member.N.

Example request

 POST / HTTP/1.1 Host: sts.backblazeb2.com Content-Type: application/x-www-form-urlencoded; charset=utf-8
Action=AssumeRole& Version=2011-06-15& RoleArn=arn:aws:iam::123456789012:role/analytics-role& RoleSessionName=session-001& DurationSeconds=3600& SourceIdentity=deployment-job& Tag.1.Key=team& Tag.1.Value=analytics

Example response

 <AssumeRoleResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
  <AssumeRoleResult>
    <Credentials>
      <AccessKeyId>ASIAIOSFODNN7EXAMPLE</AccessKeyId>
      <SecretAccessKey>wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY</SecretAccessKey>
      <SessionToken>IQoJb3JpZ2luX2VjE...</SessionToken>
      <Expiration>2026-02-03T22:10:00Z</Expiration>
    </Credentials>
    <AssumedRoleUser>
      <AssumedRoleId>AROAEXAMPLE123456789:session-001</AssumedRoleId>
      <Arn>arn:aws:sts::123456789012:assumed-role/analytics-role/session-001</Arn>
    </AssumedRoleUser>
    <PackedPolicySize>12</PackedPolicySize>
  </AssumeRoleResult>
  <ResponseMetadata>
    <RequestId>req-1234567890</RequestId>
  </ResponseMetadata>
</AssumeRoleResponse>

Example: AssumeRole with a restrictive inline session policy

 {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "RestrictSessionToUploads",
      "Effect": "Allow",
      "Action": ["s3:PutObject"],
      "Resource": ["arn:aws:s3:::analytics-bucket/uploads/*"]
    }
  ]
}

Errors

AccessDenied
MalformedPolicyDocument
ValidationError
LimitExceeded

AssumeRole returns 403 AccessDenied when the requested role cannot be resolved or assumed.

Security

API Key: sigv4

Header parameter nameAuthorization

AWS Signature Version 4. The Authorization header takes the form AWS4-HMAC-SHA256 Credential=..., SignedHeaders=..., Signature=.... For IAM and STS requests, the signing region is not validated; use any non-empty region value consistently. The signing service must be iam for IAM requests and sts for STS requests. When using temporary credentials, also include X-Amz-Security-Token: <session-token>.

Body parameters

object

Action

string Required

Valid values[ "AssumeRole" ]

Version

string Required

Valid values[ "2011-06-15" ]

RoleArn

string Required

Examplearn:aws:iam::123456789012:role/analytics-role

RoleSessionName

string Required

Examplesession-001

DurationSeconds

integer

Minimum900

Maximum43200

Example3600

Policy

string

URL-encoded inline session policy JSON. Maximum 2,048 characters after decoding.

SourceIdentity

string

Exampledeployment-job

property*

string additionalProperties

Session tag entries (Tag.1.Key, Tag.1.Value, Tag.2.Key, Tag.2.Value, ...). Up to 50 tags per request.

Responses

200

The request succeeded. The response body is an XML document specific to the Action invoked, with a ResponseMetadata block containing a RequestId.

string

Action-specific XML response. See the example response for each operation.

400

The request was malformed or failed validation.

HTTP Status	Code	Description
400	ValidationError	Invalid input parameter or failed validation.
400	MalformedPolicyDocument	Policy JSON is invalid or unsupported.

string

403

The caller is not authorized. For operations that reference IAM resources, authorization may be evaluated before resource existence is disclosed.

HTTP Status	Code	Description
403	AccessDenied	The authenticated principal lacks permission for this action.

string

429

The request was rate-limited.

HTTP Status	Code	Description
429	Throttling	Too many requests. Use exponential backoff.

string

500

The server encountered an unexpected condition.

HTTP Status	Code	Description
500	InternalFailure	Unexpected server error.

string

Was this article helpful?

What's Next

GetCallerIdentity (GET)