helm-external-secrets/docs/api/generator/stsassumerole.md

STSAssumeRoleToken uses sts:AssumeRole to obtain temporary AWS credentials.

Unlike STSSessionToken (which calls GetSessionToken), this generator works with any type of AWS credentials — including temporary session credentials from IRSA / pod identity — making it suitable for on-premises clusters, EKS with IRSA, or any environment where the caller already holds temporary credentials.

When to use STSAssumeRoleToken vs STSSessionToken

Scenario	Generator
Long-term IAM credentials, need MFA enforcement	STSSessionToken
Long-term IAM credentials, need to assume a role	STSAssumeRoleToken
IRSA / pod identity (temporary credentials) + role assumption	STSAssumeRoleToken
IRSA / pod identity, no additional role assumption needed	Use ECRAuthorizationToken or provider directly

Output Keys and Values

Key	Description
access_key_id	The access key ID of the assumed role credentials.
secret_access_key	The secret access key of the assumed role credentials.
session_token	The session token required to use the temporary credentials.
expiration	Unix timestamp (seconds) at which the credentials expire. Absent if unknown.

Authentication

You can use either:

• Static credentials via spec.auth.secretRef — a Kubernetes Secret containing your long-term IAM access key and secret.
• IRSA / service account token via spec.auth.jwt — uses the pod's projected service account token to call AssumeRoleWithWebIdentity, then chains an additional AssumeRole to the target role.

If neither is specified, the AWS SDK default credential chain is used (environment variables, EC2 instance metadata, etc.).

Request Parameters

Field	Description
requestParameters.sessionDuration	Duration in seconds for the assumed role session. Range: 900–43200. Default: 3600 (1 hour).
requestParameters.externalID	External ID for cross-account role assumption. Required when the role trust policy enforces it.

Example Manifest

{% include 'generator-stsassumerole.yaml' %}

Example ExternalSecret that references the STSAssumeRoleToken generator:

{% include 'generator-stsassumerole-example.yaml' %}