AWS provides the Security Token Service (STS) web service that enables you to request temporary, limited-privilege credentials for users. STS allows a single AWS Step integration instance to be used for multiple AWS accounts, reducing the number of integration instances that need to be created.
The most common way to use STS to request temporary, limited-privilege credentials in Workflows is via a generic AWS CLI command Step that runs an aws sts assume-role command.
Set up an AWS Steps integration instance: See the guide on creating an AWS Steps integration instance.
Open the Workflow: In Torq, navigate to Build > Workflows and select the relevant Workflow.
Add the Step: Add the AWS CLI command Step to the Workflow.
Edit the Step's parameters:
Enter the command
sts assume-role --role-arn <role ARN> --role-session-name "torq-assumed-session"with the AWS role ARN you copied earlier.Enter the role ARN again.
Select the relevant AWS Steps integration instance with the correct permissions.
Run the Step: Click Execute on the Step or run the Workflow. The output will look similar to:
{
"error": "",
"exit_code": 0,
"output": {
"AssumedRoleUser": {
"Arn": "arn:aws:sts::************:assumed-role/acita_torq_security_lake_custom_source/torq-assumed-session",
"AssumedRoleId": "**********************:torq-assumed-session"
},
"Credentials": {
"AccessKeyId": "A*********************V",
"Expiration": "2023-03-17T17:20:21+00:00",
"SecretAccessKey": "zc******************************dDh",
"SessionToken": "Fwo*********************************************************************************************************************="
}
},
"output_file": "",
"step_status": {
"code": 1,
"message": "",
"verbose": ""
}
}Save the credentials: Save
AccessKeyId,SecretAccessKey, andSessionTokenfor later. They are the temporary credentials that can be used in other Steps such as Run a Python script.
