Trade a signed AWS caller-identity request for a machine credential
A workload signs a call that only asks AWS who it is, and we replay that call to find out.
/api/v1/auth/awsA workload signs a call that only asks AWS who it is, and we replay that call to find out. Use it from EC2, ECS, Lambda or EKS, where the instance or task role is proof enough and nothing secret has to leave the machine. Each signed request is accepted once.
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
A SigV4-signed sts:GetCallerIdentity request, replayed by us to learn who signed it. The body is byte-for-byte Action=GetCallerIdentity&Version=2011-06-15 because its hash is part of the signature, and the workspace id must be signed as the x-penv-cloud-org header rather than sent beside it.
Response Body
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/api/v1/auth/aws" \ -H "Content-Type: application/json" \ -d '{ "method": "string", "url": "string", "body": "string", "headers": { "property1": "string", "property2": "string" } }'{ "credential": "string", "expiresAt": "2019-08-24T14:15:22Z"}