AssumeRole

Availability

Early Access: July 1, 2026

Early Access is gated; contact the Backblaze Sales team for access.

Limited Availability: July 1, 2026

This API is available only to customers with access to the Backblaze Enterprise Web Console. For more information, contact the Backblaze Sales team.

Return temporary security credentials for a role session

Actual request: POST / HTTP/1.1 to sts.backblazeb2.com with Action=AssumeRole in the form-encoded body.

Request parameters

Unsupported AWS STS parameters

The following AssumeRole parameters are not supported in this release: ExternalId, SerialNumber, TokenCode, PolicyArns.member.N, ProvidedContexts.member.N, TransitiveTagKeys.member.N.

Example request

 POST / HTTP/1.1 Host: sts.backblazeb2.com Content-Type: application/x-www-form-urlencoded; charset=utf-8
Action=AssumeRole& Version=2011-06-15& RoleArn=arn:aws:iam::123456789012:role/analytics-role& RoleSessionName=session-001& DurationSeconds=3600& SourceIdentity=deployment-job& Tag.1.Key=team& Tag.1.Value=analytics 

Example response

 <AssumeRoleResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
  <AssumeRoleResult>
    <Credentials>
      <AccessKeyId>ASIAIOSFODNN7EXAMPLE</AccessKeyId>
      <SecretAccessKey>wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY</SecretAccessKey>
      <SessionToken>IQoJb3JpZ2luX2VjE...</SessionToken>
      <Expiration>2026-02-03T22:10:00Z</Expiration>
    </Credentials>
    <AssumedRoleUser>
      <AssumedRoleId>AROAEXAMPLE123456789:session-001</AssumedRoleId>
      <Arn>arn:aws:sts::123456789012:assumed-role/analytics-role/session-001</Arn>
    </AssumedRoleUser>
    <PackedPolicySize>12</PackedPolicySize>
  </AssumeRoleResult>
  <ResponseMetadata>
    <RequestId>req-1234567890</RequestId>
  </ResponseMetadata>
</AssumeRoleResponse> 

Example: AssumeRole with a restrictive inline session policy

 {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "RestrictSessionToUploads",
      "Effect": "Allow",
      "Action": ["s3:PutObject"],
      "Resource": ["arn:aws:s3:::analytics-bucket/uploads/*"]
    }
  ]
} 

Errors

• AccessDenied
• MalformedPolicyDocument
• ValidationError
• LimitExceeded

AssumeRole returns 403 AccessDenied when the requested role cannot be resolved or assumed.