From 2b7c382a8544106297cf614e8eabc0f621d46b30 Mon Sep 17 00:00:00 2001
From: Chris Lu <chris.lu@gmail.com>
Date: Thu, 2 Apr 2026 14:33:24 -0700
Subject: [PATCH] sts GetFederationToken GetCallerIdentity

---
 AWS-CLI-with-SeaweedFS.md  | 25 +++++++++++++++++++++++++
 Amazon-S3-API.md           |  2 +-
 Supported-APIs-vs-Minio.md |  2 ++
 3 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/AWS-CLI-with-SeaweedFS.md b/AWS-CLI-with-SeaweedFS.md
index b2bd0a2..5b34e2a 100644
--- a/AWS-CLI-with-SeaweedFS.md
+++ b/AWS-CLI-with-SeaweedFS.md
@@ -113,3 +113,28 @@ aws --endpoint-url $S3_ENDPOINT s3 cp file.txt s3://bucket/sse-s3.txt \
 
 ## OIDC/JWT to S3
 For Keycloak and other OIDC providers, you can obtain a JWT and access S3 directly (or use STS to assume a role). See [[OIDC Integration]].
+
+## STS (Security Token Service)
+
+### Get Caller Identity
+Verify your credentials and see who you are authenticated as:
+```bash
+aws --endpoint-url $S3_ENDPOINT sts get-caller-identity
+```
+
+### Get Federation Token
+Obtain temporary credentials scoped down with an optional session policy (only long-term IAM users can call this):
+```bash
+aws --endpoint-url $S3_ENDPOINT sts get-federation-token \
+  --name my-session \
+  --duration-seconds 3600
+```
+
+With an inline session policy to restrict permissions:
+```bash
+aws --endpoint-url $S3_ENDPOINT sts get-federation-token \
+  --name my-session \
+  --policy '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"}]}'
+```
+
+For `AssumeRole` and `AssumeRoleWithWebIdentity`, see [[OIDC Integration]].
diff --git a/Amazon-S3-API.md b/Amazon-S3-API.md
index acdb939..d6bc48a 100644
--- a/Amazon-S3-API.md
+++ b/Amazon-S3-API.md
@@ -167,7 +167,7 @@ SeaweedFS also implements these related AWS service APIs on the same S3 endpoint
 
 | Service | Operations | Documentation |
 |---|---|---|
-| Security Token Service (STS) | AssumeRole, AssumeRoleWithWebIdentity, AssumeRoleWithLDAPIdentity | [[OIDC Integration]] |
+| Security Token Service (STS) | AssumeRole, AssumeRoleWithWebIdentity, AssumeRoleWithLDAPIdentity, GetFederationToken, GetCallerIdentity | [[OIDC Integration]] |
 | IAM API | User, policy, access key, and group management | [[Amazon IAM API]], [[AWS IAM CLI]] |
 | S3 Tables | Table bucket, namespace, and table management (Apache Iceberg) | [[S3 Table Bucket]] |
 
diff --git a/Supported-APIs-vs-Minio.md b/Supported-APIs-vs-Minio.md
index 6bcaad7..8abf914 100644
--- a/Supported-APIs-vs-Minio.md
+++ b/Supported-APIs-vs-Minio.md
@@ -51,6 +51,8 @@ This page compares the S3 API implementation in SeaweedFS with MinIO.
 | `sts:AssumeRole` | ✅ | ✅ | Standard SigV4 auth |
 | `sts:AssumeRoleWithWebIdentity` | ✅ | ✅ | OIDC / JWT support |
 | `sts:AssumeRoleWithLDAPIdentity` | ✅ | ✅ | LDAP integration |
+| `sts:GetFederationToken` | ✅ | ❌ | Temp credentials with scoped-down policy |
+| `sts:GetCallerIdentity` | ✅ | ❌ | Returns ARN/account/user of caller |
 | `sts:AssumeRoleWithClientGrants` | ❌ | ✅ | MinIO extension |
 | `sts:AssumeRoleWithCertificate` | ❌ | ✅ | MinIO extension (TLS certs) |
 | `sts:AssumeRoleWithCustomToken` | ❌ | ✅ | MinIO extension |