STS

kumolo implements a subset of the STS REST API. All operations accept standard AWS SDK v2 requests — point your client at http://localhost:5566.

Support levels

Symbol	Meaning
✓	Fully implemented — the feature behaves like real AWS
◐	Partial support — the operation works but has known limitations; see the note for details
—	Not yet implemented

Operation support

Operations sourced from internal/sts/handler.go in the kumolo repository.

Operation	Supported
GetCallerIdentity	◐
AssumeRole	◐
GetSessionToken	◐
AssumeRoleWithWebIdentity	—
AssumeRoleWithSAML	—
GetFederationToken	—
DecodeAuthorizationMessage	—
GetAccessKeyInfo	—

Note

Returned credentials are fixed values regardless of the role or duration requested. AssumeRole validates RoleArn (length 20–2048) and RoleSessionName (length 2–64, pattern [\w+=,.@-]*) and returns ValidationError for invalid inputs. DurationSeconds is validated: AssumeRole accepts 900–43200 seconds; GetSessionToken accepts 900–129600 seconds. Out-of-range values return ValidationError. Returned credentials always use a fixed far-future expiration (2099-01-01T00:00:00Z).

GetCallerIdentity

Field	Fixed value
Account	000000000000
UserId	000000000000
Arn	arn:aws:iam::000000000000:root

AssumeRole

Field	Value
AssumedRoleUser.Arn	derived from RoleArn and RoleSessionName
AssumedRoleUser.AssumedRoleId	derived from RoleSessionName
Credentials.AccessKeyId	AKIAIOSFODNN7EXAMPLE
Credentials.SecretAccessKey	wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
Credentials.SessionToken	AQoDYXdzEJr
Credentials.Expiration	2099-01-01T00:00:00Z

GetSessionToken

Field	Fixed value
AccessKeyId	AKIAIOSFODNN7EXAMPLE
SecretAccessKey	wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
SessionToken	AQoDYXdzEJr
Expiration	2099-01-01T00:00:00Z

Quick start

Go

import (
    "context"
    "fmt"

    "github.com/aws/aws-sdk-go-v2/aws"
    "github.com/aws/aws-sdk-go-v2/config"
    "github.com/aws/aws-sdk-go-v2/credentials"
    "github.com/aws/aws-sdk-go-v2/service/sts"
)

cfg, err := config.LoadDefaultConfig(context.Background(),
    config.WithRegion("us-east-1"),
    config.WithCredentialsProvider(
        credentials.NewStaticCredentialsProvider("test", "test", ""),
    ),
)
if err != nil {
    panic(err)
}

client := sts.NewFromConfig(cfg, func(o *sts.Options) {
    o.BaseEndpoint = aws.String("http://localhost:5566")
})

identity, err := client.GetCallerIdentity(context.Background(), &sts.GetCallerIdentityInput{})
if err != nil {
    panic(err)
}
fmt.Println("Account:", *identity.Account)
fmt.Println("ARN:    ", *identity.Arn)

role, err := client.AssumeRole(context.Background(), &sts.AssumeRoleInput{
    RoleArn:         aws.String("arn:aws:iam::000000000000:role/my-role"),
    RoleSessionName: aws.String("my-session"),
})
if err != nil {
    panic(err)
}
fmt.Println("AccessKeyId:", *role.Credentials.AccessKeyId)

token, err := client.GetSessionToken(context.Background(), &sts.GetSessionTokenInput{})
if err != nil {
    panic(err)
}
fmt.Println("SessionToken:", *token.Credentials.SessionToken)

Python (boto3)

import boto3

sts = boto3.client(
    "sts",
    region_name="us-east-1",
    endpoint_url="http://localhost:5566",
    aws_access_key_id="test",
    aws_secret_access_key="test",
)

identity = sts.get_caller_identity()
print("Account:", identity["Account"])
print("ARN:    ", identity["Arn"])

role = sts.assume_role(
    RoleArn="arn:aws:iam::000000000000:role/my-role",
    RoleSessionName="my-session",
)
print("AccessKeyId:", role["Credentials"]["AccessKeyId"])

token = sts.get_session_token()
print("SessionToken:", token["Credentials"]["SessionToken"])

AWS CLI

aws sts get-caller-identity \
  --endpoint-url http://localhost:5566 \
  --region us-east-1

aws sts assume-role \
  --role-arn arn:aws:iam::000000000000:role/my-role \
  --role-session-name my-session \
  --endpoint-url http://localhost:5566 \
  --region us-east-1

aws sts get-session-token \
  --endpoint-url http://localhost:5566 \
  --region us-east-1