= AWS Security Token Service (STS) Component
:doctitle: AWS Security Token Service (STS)
:shortname: aws2-sts
:artifactid: camel-aws2-sts
:description: Manage AWS STS cluster instances.
:since: 3.5
:supportlevel: Stable
:tabs-sync-option:
:component-header: Only producer is supported
//Manually maintained attributes
:group: AWS
:camel-spring-boot-name: aws2-sts

*Since Camel {since}*

*{component-header}*

The AWS2 STS component supports assumeRole operation.
https://aws.amazon.com/sts/[AWS STS].

Prerequisites

You must have a valid Amazon Web Services developer account, and be
signed up to use Amazon STS. More information is available at
https://aws.amazon.com/sts/[Amazon STS].

[NOTE]
====
The AWS2 STS component works on the aws-global region, and it has aws-global as the default region.
====

== URI Format

-------------------------
aws2-sts://label[?options]
-------------------------

You can append query options to the URI in the following format:

`?options=value&option2=value&...`


// component options: START
include::partial$component-configure-options.adoc[]
include::partial$component-endpoint-options.adoc[]
include::partial$component-endpoint-headers.adoc[]
// component options: END


Required STS component options

You have to provide the amazonSTSClient in the
Registry or your accessKey and secretKey to access
the https://aws.amazon.com/sts/[Amazon STS] service.

== Usage

=== Static credentials, Default Credential Provider and Profile Credentials Provider

You have the possibility of avoiding the usage of explicit static credentials by specifying the useDefaultCredentialsProvider option and set it to true.

The order of evaluation for Default Credentials Provider is the following:

 - Java system properties - `aws.accessKeyId` and `aws.secretKey`.
 - Environment variables - `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`.
 - Web Identity Token from AWS STS.
 - The shared credentials and config files.
 - Amazon ECS container credentials - loaded from the Amazon ECS if the environment variable `AWS_CONTAINER_CREDENTIALS_RELATIVE_URI` is set.
 - Amazon EC2 Instance profile credentials. 

You have also the possibility of using Profile Credentials Provider, by specifying the useProfileCredentialsProvider option to true and profileCredentialsName to the profile name.

Only one of static, default and profile credentials could be used at the same time.

For more information about this you can look at https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/credentials.html[AWS credentials documentation]

=== STS Producer operations

Camel-AWS STS component provides the following operation on the producer side:

- assumeRole
- getSessionToken
- getFederationToken

== Examples

=== Producer Examples

- assumeRole: this operation will make an AWS user assume a different role temporary

[source,java]
--------------------------------------------------------------------------------
from("direct:assumeRole")
    .setHeader(STS2Constants.ROLE_ARN, constant("arn:123"))
    .setHeader(STS2Constants.ROLE_SESSION_NAME, constant("groot"))
    .to("aws2-sts://test?stsClient=#amazonSTSClient&operation=assumeRole")
--------------------------------------------------------------------------------

- getSessionToken: this operation will return a temporary session token

[source,java]
--------------------------------------------------------------------------------
from("direct:getSessionToken")
    .to("aws2-sts://test?stsClient=#amazonSTSClient&operation=getSessionToken")
--------------------------------------------------------------------------------

- getFederationToken: this operation will return a temporary federation token

[source,java]
--------------------------------------------------------------------------------
from("direct:getFederationToken")
    .setHeader(STS2Constants.FEDERATED_NAME, constant("federation-account"))
    .to("aws2-sts://test?stsClient=#amazonSTSClient&operation=getSessionToken")
--------------------------------------------------------------------------------

=== Using a POJO as body

Sometimes building an AWS Request can be complex because of multiple options. We introduce the possibility to use a POJO as the body.
In AWS STS, as an example for Assume Role request, you can do something like:

[source,java]
------------------------------------------------------------------------------------------------------
from("direct:createUser")
     .setBody(AssumeRoleRequest.builder().roleArn("arn:123").roleSessionName("groot").build())
    .to("aws2-sts://test?stsClient=#amazonSTSClient&operation=assumeRole&pojoRequest=true")
------------------------------------------------------------------------------------------------------

In this way, you'll pass the request directly without the need of passing headers and options specifically related to this operation.

== Dependencies

Maven users will need to add the following dependency to their pom.xml.

*pom.xml*

[source,xml]
---------------------------------------
<dependency>
    <groupId>org.apache.camel</groupId>
    <artifactId>camel-aws2-sts</artifactId>
    <version>${camel-version}</version>
</dependency>
---------------------------------------

where `$\{camel-version}` must be replaced by the actual version of Camel.


include::spring-boot:partial$starter.adoc[]
