Skip to main content

Assume IoT user role scoped to a group

POST 
/v1/groups/:groupId/assumed-roles

Assumes an IoT user role scoped to the specified group. The returned credentials are restricted to this group instead of all of the caller's groups, which keeps the STS session policy at a constant size no matter how many groups the caller can reach.

Open to any authenticated caller. The scope is resolved from the caller's own access, never widened: an admin caller gets the whole named group, a member with full-group access gets that group, and a member holding only shared subgroups of it gets exactly those subgroups. A caller with no access to the group is refused with 403.

Request​

Responses​

Successful response with new credentials