sts GetFederationToken GetCallerIdentity

AWS-CLI-with-SeaweedFS.md

@@ -113,3 +113,28 @@ aws --endpoint-url $S3_ENDPOINT s3 cp file.txt s3://bucket/sse-s3.txt \
 
 ## OIDC/JWT to S3
 For Keycloak and other OIDC providers, you can obtain a JWT and access S3 directly (or use STS to assume a role). See [[OIDC Integration]].
+
+## STS (Security Token Service)
+
+### Get Caller Identity
+Verify your credentials and see who you are authenticated as:
+```bash
+aws --endpoint-url $S3_ENDPOINT sts get-caller-identity
+```
+
+### Get Federation Token
+Obtain temporary credentials scoped down with an optional session policy (only long-term IAM users can call this):
+```bash
+aws --endpoint-url $S3_ENDPOINT sts get-federation-token \
+  --name my-session \
+  --duration-seconds 3600
+```
+
+With an inline session policy to restrict permissions:
+```bash
+aws --endpoint-url $S3_ENDPOINT sts get-federation-token \
+  --name my-session \
+  --policy '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"}]}'
+```
+
+For `AssumeRole` and `AssumeRoleWithWebIdentity`, see [[OIDC Integration]].

Amazon-S3-API.md

@@ -167,7 +167,7 @@ SeaweedFS also implements these related AWS service APIs on the same S3 endpoint
 
 | Service | Operations | Documentation |
 |---|---|---|
-| Security Token Service (STS) | AssumeRole, AssumeRoleWithWebIdentity, AssumeRoleWithLDAPIdentity | [[OIDC Integration]] |
+| Security Token Service (STS) | AssumeRole, AssumeRoleWithWebIdentity, AssumeRoleWithLDAPIdentity, GetFederationToken, GetCallerIdentity | [[OIDC Integration]] |
 | IAM API | User, policy, access key, and group management | [[Amazon IAM API]], [[AWS IAM CLI]] |
 | S3 Tables | Table bucket, namespace, and table management (Apache Iceberg) | [[S3 Table Bucket]] |
 

Supported-APIs-vs-Minio.md

@@ -51,6 +51,8 @@ This page compares the S3 API implementation in SeaweedFS with MinIO.
 | `sts:AssumeRole` | ✅ | ✅ | Standard SigV4 auth |
 | `sts:AssumeRoleWithWebIdentity` | ✅ | ✅ | OIDC / JWT support |
 | `sts:AssumeRoleWithLDAPIdentity` | ✅ | ✅ | LDAP integration |
+| `sts:GetFederationToken` | ✅ | ❌ | Temp credentials with scoped-down policy |
+| `sts:GetCallerIdentity` | ✅ | ❌ | Returns ARN/account/user of caller |
 | `sts:AssumeRoleWithClientGrants` | ❌ | ✅ | MinIO extension |
 | `sts:AssumeRoleWithCertificate` | ❌ | ✅ | MinIO extension (TLS certs) |
 | `sts:AssumeRoleWithCustomToken` | ❌ | ✅ | MinIO extension |