AWS STS getFederationToken的主要用例是什么？
参考这篇文章，有 5 个 API使用 STS 检索凭据：
AssumeRoleAssumeRoleWithWebIdentityAssumeRoleWithSAMLGetFederationTokenGetSessionToken
AssumeRole 对于使用 IAM 角色集中管理权限非常有用。 Web 身份和 SAML 联合也很简单。 GetSessionToken 对于保护敏感 IAM 用户和保护来自不安全位置的连接非常有用，尤其是使用 MFA。我过去也用过这个。
但是，与 AssumeRole 相比，GetFederationToken 的主要用途是什么？这篇文章似乎表明，关键的区别在于它允许更长的有效期。这真的是这个 API 的主要目的吗？为什么为了延长有效期而使用不同的 API 至关重要？
Referring to this article, there are 5 APIs to retrieve credentials using STS:
AssumeRoleAssumeRoleWithWebIdentityAssumeRoleWithSAMLGetFederationTokenGetSessionToken
AssumeRole is useful for managing permissions centrally using IAM roles. Web identity and SAML federation are also straightforward. GetSessionToken is useful to protect sensitive IAM users and to protect connections from insecure locations, especially using MFA. I have also used this in the past.
However, what is the main purpose for GetFederationToken, in comparison to AssumeRole? The article seems to suggest the key difference is that it allows for a substantially longer expiration. Is this really the primary purpose of this API? Why is it crucial to have a different API just for longer expiration?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
除到期外，
asheroleasherole显然需要在策略中发挥作用。getFederationtoken由IAM用户的凭据调用，并且不涉及角色。getFederatikentoken与getsessionToken更相似，但在会话策略支持下。同样，对结果临时凭证的限制也不同，请参见。getFederationToken的用例：在没有角色时，会从IAM用户使用IAM用户创建临时凭据。There are a few difference between
AssumeRoleandGetFederationTokenapart from expiration.AssumeRoleobviously requires a role with policies.GetFederationTokenis called by the credentials of an IAM user, and it doesn't involve roles.GetFederationTokenis more similar toGetSessionTokenbut with session policy support. Also the restrictions on resulting temporary credentials are different, see here.Use case for
GetFederationToken: creating temporary credentials from IAM user with session policy when there is no role to assume.GetFeDerationToken可以更好地适用于与外部系统认证的用户打交道的方案，并且您不会直接管理这些外部帐户。 Auderolewithwebidentity更适合您直接管理的帐户/身份提供商。
GetFederationToken is better for scenarios where you're dealing with users authenticated by external systems, and you're not managing those external accounts directly. AssumeRoleWithWebIdentity is better for accounts/identity providers you manage directly.