sts:GetWebIdentityToken is a Write access-level action in the sts service. Grants permission to obtain a short-lived, publicly verifiable JSON Web Token (JWT) that represents the calling IAM principal's identity
This action does not support resource-level permissions; use "Resource": "*" in your policy.
Keys you can use in the Condition block of a policy that grants sts:GetWebIdentityToken.
Filters access by the tags that are passed in the request
Filters access by the tag keys that are passed in the request
Filters access by the duration in seconds when getting a bearer token or a JSON Web Token (JWT) from the GetWebIdentityToken API
Filters access by the audience that is passed in the request
Filters access by the signing algorithm that is passed in the request
A minimal policy that allows sts:GetWebIdentityToken. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowStsGetWebIdentityToken",
"Effect": "Allow",
"Action": "sts:GetWebIdentityToken",
"Resource": "*"
}
]
}