<commit_before>[id="cco-mode-sts"]
= Using manual mode with STS
include::modules/common-attributes.adoc[]
:context: cco-mode-sts

toc::[]

Manual mode with STS is supported for Amazon Web Services (AWS).

In manual mode with STS, the individual {product-title} cluster components use AWS Secure Token Service (STS) to assign components IAM roles that provide short-term, limited-privilege security credentials. These credentials are associated with IAM roles that are specific to each component that makes AWS API calls.

Requests for new and refreshed credentials are automated by using an appropriately configured AWS IAM OpenID Connect (OIDC) identity provider, combined with AWS IAM roles. {product-title} signs service account tokens that are trusted by AWS IAM, and can be projected into a pod and used for authentication. Tokens are refreshed after one hour.

//to-do: more detailed info on this flow

.STS authentication flow
image::142_OpenShift_credentials_STS_0221.svg[Detailed authentication flow between AWS and the cluster when using AWS STS]
//to-do: improve alt-text

Using manual mode with STS changes the content of the AWS credentials that are provided to individual {product-title} components.

.AWS secret format using long-lived credentials

[source,yaml]
----
apiVersion: v1
kind: Secret
metadata:
  namespace: <target-namespace> <1>
  name: <target-secret-name> <2>
data:
  aws_access_key_id: <base64-encoded-access-key-id>
  aws_secret_access_key: <base64-encoded-secret-access-key>
----
<1> The namespace for the component.
<2> The name of the component secret.

.AWS secret format with STS

[source,yaml]
----
apiVersion: v1
kind: Secret
metadata:
  namespace: <target-namespace> <1>
  name: <target-secret-name> <2>
data:
  role_name: <operator-role-name> <3>
  web_identity_token_file: <path-to-token> <4>
----
<1> The namespace for the component.<commit_msg>BZ2024198 incorrect STS secret format<commit_after>[id="cco-mode-sts"]
= Using manual mode with STS
include::modules/common-attributes.adoc[]
:context: cco-mode-sts

toc::[]

Manual mode with STS is supported for Amazon Web Services (AWS).

In manual mode with STS, the individual {product-title} cluster components use AWS Secure Token Service (STS) to assign components IAM roles that provide short-term, limited-privilege security credentials. These credentials are associated with IAM roles that are specific to each component that makes AWS API calls.

Requests for new and refreshed credentials are automated by using an appropriately configured AWS IAM OpenID Connect (OIDC) identity provider, combined with AWS IAM roles. {product-title} signs service account tokens that are trusted by AWS IAM, and can be projected into a pod and used for authentication. Tokens are refreshed after one hour.

//to-do: more detailed info on this flow

.STS authentication flow
image::142_OpenShift_credentials_STS_0221.svg[Detailed authentication flow between AWS and the cluster when using AWS STS]
//to-do: improve alt-text

Using manual mode with STS changes the content of the AWS credentials that are provided to individual {product-title} components.

.AWS secret format using long-lived credentials

[source,yaml]
----
apiVersion: v1
kind: Secret
metadata:
  namespace: <target-namespace> <1>
  name: <target-secret-name> <2>
data:
  aws_access_key_id: <base64-encoded-access-key-id>
  aws_secret_access_key: <base64-encoded-secret-access-key>
----
<1> The namespace for the component.
<2> The name of the component secret.

.AWS secret format with STS

[source,yaml]
----
apiVersion: v1
kind: Secret
metadata:
  namespace: <target-namespace> <1>
  name: <target-secret-name> <2>
stringData:
  credentials: |-
    [default]
    role_name: <operator-role-name> <3>
    web_identity_token_file: <path-to-token> <4>
----
<1> The namespace for the component.
{'fraction_non_alphanumeric': 0.08719416970327955, 'fraction_numerical': 0.01327433628318584, 'mean_word_length': 4.693333333333333, 'pattern_counts': {'":': 0, '<': 37, '<?xml version=': 0, '>': 37, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '258766', 'n_tokens_mistral': 1131, 'n_tokens_neox': 1095, 'n_words': 463}