AWS SSO GetRoleCredentials API 详解#
ref: https://docs.aws.amazon.com/singlesignon/latest/PortalAPIReference/API_GetRoleCredentials.html
返回分配给用户的给定角色名称的 STS 短期凭证。
请求语法#
HTTP
GET /federation/credentials?account_id=accountId&role_name=roleName HTTP/1.1x-amz-sso_bearer_token: accessToken-
accessToken- 通过 CreateToken API 获取的令牌。
- 是否必须： 是
-
accountId- 分配给用户的 AWS 账户的标识符。
- 是否必须： 是
-
roleName- 分配给用户的角色名称。
- 是否必须： 是
响应语法#
JSON
HTTP/1.1 200Content-type: application/json { "roleCredentials": { "accessKeyId": "string", "expiration": number, "secretAccessKey": "string", "sessionToken": "string" }}实例#
URL 地址：https://portal.sso.{region}.amazonaws.com
这里的 region 替换成实际的 region 即可。
注意：以下例子中，为了便于展示，对所有的 JSON 进行了格式化。
1. 请求#
HTTP
GET /federation/credentials?account_id=42xxxxx44&role_name=xxx HTTP/1.1Host: portal.sso.us-east-1.amazonaws.comAccept-Encoding: gzip, deflateConnection: closex-amz-sso_bearer_token: ****** 2. 响应#
HTTP
HTTP/1.1 200 OKDate: Wed, 10 Sep 2025 07:14:05 GMTContent-Type: application/jsonContent-Length: 1080Connection: closeAccess-Control-Expose-Headers: RequestIdAccess-Control-Expose-Headers: x-amzn-RequestIdCache-Control: no-cacheRequestId: 2683b57e-cc3d-412d-b6a9-484f57cbd497Server: AWS SSOx-amzn-RequestId: 2683b57e-cc3d-412d-b6a9-484f57cbd497 { "roleCredentials": { "accessKeyId":"ASIAWFSxxxxxxxxJW", "secretAccessKey":******, "sessionToken":******, "expiration":1757492044000 }}