Assume Role
sts.assume_role
ActionAmazon Web Servicesconnection required
Calls the AWS sts API (SigV4).
Get temporary credentials for a role.
Connection
- Required
- Yes — the node will not save without one
- Auth type
- API key
- Providers
- AWS STS
- Secret shape
- {"access_key_id", "secret_access_key"}
- Config it needs
- region
- Resolved by
- config.connection_id, else node.connection_id
Configuration
5 fields, 2 required. A dotted path is a nested object and name[] an array of objects — the editor renders the same tree.
| Field | Type | Required | Default | Constraints | Example |
|---|---|---|---|---|---|
region AWS region (overrides the connection). | string | No | — | — | — |
role_arn Role ARN to assume. | string | Yes | — | — | — |
session_name Session name for CloudTrail. | string | Yes | — | — | — |
duration_seconds Lifetime in seconds (default 3600). | number | No | — | 900–43200 | — |
external_id External id, if the trust policy needs one. | string | No | — | — | — |
Output
One shape.
result
| Field | Type | Example |
|---|---|---|
access_key_id | string | — |
session_token | string | — |
expiration | string | — |
secret_access_key The temporary secret access key. Declared because it IS returned: leaving it undeclared hid it from the editor while the value flowed into the step output regardless, which is the worse of the two. | string | — |
assumed_role_arn | string | — |
{
"access_key_id": "",
"assumed_role_arn": "",
"expiration": "",
"secret_access_key": "",
"session_token": ""
}Notes
- Returns live credentials as step output — only use it when downstream needs them.
Related AWS STS nodes
See Assume Role run in a workflow.
In a technical demo we add the AWS STS connection, drop the node on the canvas and let Workflow Health pre-flight it before the first real run.