The AssumeRole method allows you to obtain temporary security credentials by assuming an Alibaba Cloud RAM role. This is useful for implementing the principle of least privilege by using short-lived credentials instead of long-term AccessKey/SecretKey pairs.
To use this, you must initialize a Client with your permanent credentials and the target RoleArn. The AssumeRole method then returns a Response containing Credentials (including an AccessKeyId, AccessKeySecret, and a SecurityToken) and an AssumedRoleUser object.
// Initialize the STS client
stsClient := lib.NewClient("YOUR_ACCESS_KEY_ID", "YOUR_ACCESS_KEY_SECRET", "arn:aliyun:ram::1234567890:role/YourRoleName", "session-name")
// Assume the role
// tokenTimeout: duration in seconds for the temporary credentials
// stsEndPoint: optional custom STS endpoint (e.g., for regional endpoints)
response, err := stsClient.AssumeRole(3600, "")
if err != nil {
log.Fatalf("Failed to assume role: %v", err)
}
// Use the returned credentials
fmt.Printf("Temporary AccessKeyId: %s\n", response.Credentials.AccessKeyId)
fmt.Printf("Security Token: %s\n", response.Credentials.SecurityToken)
fmt.Printf("Expiration: %v\n", response.Credentials.Expiration)