sts:SetContext

Write

sts:SetContext is a Write access-level action in the sts service. Grants permission to set context keys on a STS session

Resource types

ARNs that sts:SetContext can be scoped to in an IAM policy.

arn:${Partition}:iam::${Account}:role/${RoleNameWithPath}
role
arn:${Partition}:sts::${Account}:self
self-session

Condition keys

Keys you can use in the Condition block of a policy that grants sts:SetContext.

sts:RequestContext/${ContextKey} String

Filters access by the session context key-value pairs embedded in the signed context assertion retrieved from a trusted context provider

sts:RequestContextProviders ArrayOfARN

Filters access by the context provider ARNs

aws:ResourceTag/${TagKey} String

Filters access by the tags associated with the resource

iam:ResourceTag/${TagKey} String

Filters access by the tags that are attached to the role that is being assumed

Example IAM policy

A minimal policy that allows sts:SetContext. Replace "Resource": "*" with a specific ARN to follow least privilege.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowStsSetContext",
      "Effect": "Allow",
      "Action": "sts:SetContext",
      "Resource": "*"
    }
  ]
}

Related actions in sts

sts:AssumeRole Write sts:AssumeRoleWithSAML Write sts:AssumeRoleWithWebIdentity Write sts:AssumeRoot Write sts:DecodeAuthorizationMessage Write sts:GetAccessKeyInfo Read sts:GetCallerIdentity Read sts:GetDelegatedAccessToken Write sts:GetFederationToken Write sts:GetServiceBearerToken Read sts:GetSessionToken Read sts:GetWebIdentityToken Write

View all sts actions →