A RetroSearch Logo

Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Search Query:

Showing content from https://developer.hashicorp.com/vault/api-docs/auth/aws below:

AWS - Auth Methods - HTTP API | Vault

Note

This engine can use external X.509 certificates as part of TLS or signature validation. Verifying signatures against X.509 certificates that use SHA-1 is deprecated and is no longer usable without a workaround starting in Vault 1.12. Refer to the deprecation notices for more information.

This is the API documentation for the Vault AWS auth method. For general information about the usage and operation of the AWS method, please see the Vault AWS method documentation.

This documentation assumes the AWS method is mounted at the /auth/aws path in Vault. Since it is possible to enable auth methods at any location, please update your API calls accordingly.

Vault 1.7 deprecated several AWS Auth URLs. The full list of affected endpoints and their replacements is provided at the end of this document.

Configures the credentials required to perform API calls to AWS as well as custom endpoints to talk to AWS APIs. The instance identity document fetched from the PKCS#7 signature will provide the EC2 instance ID. The credentials configured using this endpoint will be used to query the status of the instances via DescribeInstances API. If static credentials are not provided using this endpoint, or plugin workload identity federation credentials are also not provided, then the credentials will be retrieved from the environment variables AWS_ACCESS_KEY, AWS_SECRET_KEY and AWS_REGION respectively. If the credentials are still not found and if the method is configured on an EC2 instance with metadata querying capabilities, the credentials are fetched automatically.

Method Path POST /auth/aws/config/client Parameters Sample payload 
{
  "access_key": "VKIAJBRHKH6EVTTNXDHA",
  "secret_key": "vCtSM8ZUEQ3mOFVlYPBQkf2sO6F/W7a5TVzrl3Oj"
}
Sample request 
$ curl \
    --header "X-Vault-Token: ..." \
    --request POST \
    --data @payload.json \
    http://127.0.0.1:8200/v1/auth/aws/config/client

Returns the previously configured AWS access credentials.

Method Path GET /auth/aws/config/client Sample request 
$ curl \
    --header "X-Vault-Token: ..." \
    http://127.0.0.1:8200/v1/auth/aws/config/client
Sample response 
{
  "data": {
    "access_key": "VKIAJBRHKH6EVTTNXDHA",
    "endpoint": "",
    "iam_endpoint": "",
    "sts_endpoint": "",
    "sts_region": "",
    "use_sts_region_from_client": false,
    "iam_server_id_header_value": ""
  }
}

Deletes the previously configured AWS access credentials.

Method Path DELETE /auth/aws/config/client Sample request 
$ curl \
    --header "X-Vault-Token: ..." \
    --request DELETE \
    http://127.0.0.1:8200/v1/auth/aws/config/client

When you have configured Vault with static credentials, you can use this endpoint to have Vault rotate the access key it used. Note that, due to AWS eventual consistency, after calling this endpoint, subsequent calls from Vault to AWS may fail for a few seconds until AWS becomes consistent again.

In order to call this endpoint, Vault's AWS access key MUST be the only access key on the IAM user; otherwise, generation of a new access key will fail. Once this method is called, Vault will now be the only entity that knows the AWS secret key is used to access AWS.

Method Path POST /auth/aws/config/rotate-root Parameters

There are no parameters to this operation.

Sample request 
    --header "X-Vault-Token: ..." \
    --request POST \
    http://127.0.0.1:8200/v1/auth/aws/config/rotate-root
Sample response 
{
  "data": {
    "access_key": "AKIA..."
  }
}

The new access key Vault uses is returned by this operation.

This configures the way that Vault interacts with the Identity store. The default (as of Vault 1.0.3) is role_id for both values.

Method Path POST /auth/aws/config/identity Parameters Sample payload 
{
  "iam_alias": "unique_id"
}
Sample request 
$ curl \
    -- header "X-Vault-Token:..." \
    --request POST
    --data @payload.json \
    http://127.0.0.1:8200/v1/auth/aws/config/identity

Returns the previously configured Identity integration configuration

Method Path GET /auth/aws/config/identity Sample request 
$ curl \
    --header "X-Vault-Token:..." \
    http://127.0.0.1:8200/v1/auth/aws/config/identity
Sample response 
{
  "data": {
    "iam_alias": "full_arn"
  }
}

Registers an AWS public key to be used to verify the instance identity documents. Indicate the type of the public key using the type parameter. Vault has the default documented set of AWS certificates built-in.

The pkcs7 type is used to verify PKCS#7 signatures from the AWS http://169.254.169.254/latest/dynamic/instance-identity/pkcs7 and http://169.254.169.254/latest/dynamic/instance-identity/rsa2048 endpoints. Vault does not support X.509 certificates with SHA-1 signatures. If you use AWS /rsa2048 signature endpoint credentials, you must use the pkcs7 login flow.

The identity type is used to verify signatures from the http://169.254.169.254/latest/dynamic/instance-identity/document and http://169.254.169.254/latest/dynamic/instance-identity/signature endpoints.

See the AWS docs for more information on the signature types and the corresponding certificates.

Method Path POST /auth/aws/config/certificate/:cert_name Parameters Sample payload 
{
  "aws_public_cert": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUM3VENDQXEwQ0NRQ1d1a2paNVY0YVp6QUpCZ2NxaGtqT09BUURNRnd4Q3pBSkJnTlZCQVlUQWxWVE1Sa3cKRndZRFZRUUlFeEJYWVhOb2FXNW5kRzl1SUZOMFlYUmxNUkF3RGdZRFZRUUhFd2RUWldGMGRHeGxNU0F3SGdZRApWUVFLRXhkQmJXRjZiMjRnVjJWaUlGTmxjblpwWTJWeklFeE1RekFlRncweE1qQXhNRFV4TWpVMk1USmFGdzB6Ck9EQXhNRFV4TWpVMk1USmFNRnd4Q3pBSkJnTlZCQVlUQWxWVE1Sa3dGd1lEVlFRSUV4QlhZWE5vYVc1bmRHOXUKSUZOMFlYUmxNUkF3RGdZRFZRUUhFd2RUWldGMGRHeGxNU0F3SGdZRFZRUUtFeGRCYldGNmIyNGdWMlZpSUZObApjblpwWTJWeklFeE1RekNDQWJjd2dnRXNCZ2NxaGtqT09BUUJNSUlCSHdLQmdRQ2prdmNTMmJiMVZRNHl0LzVlCmloNU9PNmtLL24xTHpsbHI3RDhad3RRUDhmT0VwcDVFMm5nK0Q2VWQxWjFnWWlwcjU4S2ozbnNzU05wSTZiWDMKVnlJUXpLN3dMY2xuZC9Zb3pxTk5tZ0l5WmVjTjdFZ2xLOUlUSEpMUCt4OEZ0VXB0M1FieVlYSmRtVk1lZ042UApodmlZdDVKSC9uWWw0aGgzUGExSEpkc2tnUUlWQUxWSjNFUjExK0tvNHRQNm53dkh3aDYrRVJZUkFvR0JBSTFqCmsrdGtxTVZIdUFGY3ZBR0tvY1Rnc2pKZW02LzVxb216SnVLRG1iSk51OVF4dzNyQW90WGF1OFFlK01CY0psL1UKaGh5MUtIVnBDR2w5ZnVlUTJzNklMMENhTy9idXljVTFDaVlRazQwS05IQ2NIZk5pWmJkbHgxRTlycFVwN2JuRgpsUmEydjFudE1YM2NhUlZEZGJ0UEVXbWR4U0NZc1lGRGs0bVpyT0xCQTRHRUFBS0JnRWJtZXZlNWY4TElFL0dmCk1ObVA5Q001ZW92UU9HeDVobzhXcUQrYVRlYnMrazJ0bjkyQkJQcWVacXBXUmE1UC8ranJkS21sMXF4NGxsSFcKTVhyczNJZ0liNitoVUlCK1M4ZHo4L21tTzBicHI3NlJvWlZDWFlhYjJDWmVkRnV0N3FjM1dVSDkrRVVBSDVtdwp2U2VEQ09VTVlRUjdSOUxJTll3b3VISXppcVFZTUFrR0J5cUdTTTQ0QkFNREx3QXdMQUlVV1hCbGs0MHhUd1N3CjdIWDMyTXhYWXJ1c2U5QUNGQk5HbWRYMlpCclZOR3JOOU4yZjZST2swazlLCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K"
}
Sample request 
$ curl \
    --header "X-Vault-Token: ..." \
    --request POST \
    --data @payload.json \
    http://127.0.0.1:8200/v1/auth/aws/config/certificate/test-cert

Returns the previously configured AWS public key.

Method Path GET /auth/aws/config/certificate/:cert_name Parameters Sample request 
$ curl \
    --header "X-Vault-Token: ..." \
    http://127.0.0.1:8200/v1/auth/aws/config/certificate/test-cert
Sample response 
{
  "data": {
    "aws_public_cert": "-----BEGIN CERTIFICATE-----\nMIIC7TCCAq0CCQCWukjZ5V4aZzAJBgcqhkjOOAQDMFwxCzAJBgNVBAYTAlVTMRkw\nFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYD\nVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAeFw0xMjAxMDUxMjU2MTJaFw0z\nODAxMDUxMjU2MTJaMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9u\nIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNl\ncnZpY2VzIExMQzCCAbcwggEsBgcqhkjOOAQBMIIBHwKBgQCjkvcS2bb1VQ4yt/5e\nih5OO6kK/n1Lzllr7D8ZwtQP8fOEpp5E2ng+D6Ud1Z1gYipr58Kj3nssSNpI6bX3\nVyIQzK7wLclnd/YozqNNmgIyZecN7EglK9ITHJLP+x8FtUpt3QbyYXJdmVMegN6P\nhviYt5JH/nYl4hh3Pa1HJdskgQIVALVJ3ER11+Ko4tP6nwvHwh6+ERYRAoGBAI1j\nk+tkqMVHuAFcvAGKocTgsjJem6/5qomzJuKDmbJNu9Qxw3rAotXau8Qe+MBcJl/U\nhhy1KHVpCGl9fueQ2s6IL0CaO/buycU1CiYQk40KNHCcHfNiZbdlx1E9rpUp7bnF\nlRa2v1ntMX3caRVDdbtPEWmdxSCYsYFDk4mZrOLBA4GEAAKBgEbmeve5f8LIE/Gf\nMNmP9CM5eovQOGx5ho8WqD+aTebs+k2tn92BBPqeZqpWRa5P/+jrdKml1qx4llHW\nMXrs3IgIb6+hUIB+S8dz8/mmO0bpr76RoZVCXYab2CZedFut7qc3WUH9+EUAH5mw\nvSeDCOUMYQR7R9LINYwouHIziqQYMAkGByqGSM44BAMDLwAwLAIUWXBlk40xTwSw\n7HX32MxXYruse9ACFBNGmdX2ZBrVNGrN9N2f6ROk0k9K\n-----END CERTIFICATE-----\n",
    "type": "pkcs7"
  }
}

Removes the previously configured AWS public key.

Method Path DELETE /auth/aws/config/certificate/:cert_name Sample request 
$ curl \
    --header "X-Vault-Token: ..." \
    --request DELETE \
    http://127.0.0.1:8200/v1/auth/aws/config/certificate/test-cert

Lists all the AWS public certificates that are registered with the method.

Method Path LIST /auth/aws/config/certificates Sample request 
$ curl \
    --header "X-Vault-Token: ..." \
    --request LIST \
    http://127.0.0.1:8200/v1/auth/aws/config/certificates
Sample response 
{
  "data": {
    "keys": ["cert1"]
  }
}

Allows the explicit association of STS roles to satellite AWS accounts (i.e. those which are not the account in which the Vault server is running.) Vault will use credentials obtained by assuming these STS roles when validating IAM principals or EC2 instances in the particular AWS account.

Method Path POST /auth/aws/config/sts/:account_id Parameters Sample payload 
{
  "sts_role": "arn:aws:iam:111122223333:role/myRole"
}
Sample request 
$ curl \
    --header "X-Vault-Token: ..." \
    --request POST \
    --data @payload.json \
    http://127.0.0.1:8200/v1/auth/aws/config/sts/111122223333

Returns the previously configured STS role.

Method Path GET /auth/aws/config/sts/:account_id Parameters Sample request 
$ curl \
    --header "X-Vault-Token: ..." \
    http://127.0.0.1:8200/v1/auth/aws/config/sts/111122223333
Sample response 
{
  "data": {
    "sts_role ": "arn:aws:iam:111122223333:role/myRole"
  }
}

Lists all the AWS Account IDs for which an STS role is registered.

Method Path LIST /auth/aws/config/sts Sample request 
$ curl \
    --header "X-Vault-Token: ..." \
    --request LIST \
    http://127.0.0.1:8200/v1/auth/aws/config/sts
Sample response 
{
  "data": {
    "keys": ["111122223333", "999988887777"]
  }
}

Deletes a previously configured AWS account/STS role association.

Method Path DELETE /auth/aws/config/sts/:account_id Parameters Sample request 
$ curl \
    --header "X-Vault-Token: ..." \
    --request DELETE \
    http://127.0.0.1:8200/v1/auth/aws/config/sts/111122223333

Configures the periodic tidying operation of the access listed identity entries.

Method Path POST /auth/aws/config/tidy/identity-accesslist Parameters Sample payload 
{
  "safety_buffer": "48h"
}
Sample request 
$ curl \
    --header "X-Vault-Token: ..." \
    --request POST \
    --data @payload.json \
    http://127.0.0.1:8200/v1/auth/aws/config/tidy/identity-accesslist

Returns the previously configured periodic access list tidying settings.

Method Path GET /auth/aws/config/tidy/identity-accesslist Sample request 
$ curl \
    --header "X-Vault-Token: ..." \
    http://127.0.0.1:8200/v1/auth/aws/config/tidy/identity-accesslist
Sample response 
{
  "data": {
    "safety_buffer": 600,
    "disable_periodic_tidy": false
  }
}

Deletes the previously configured periodic access list tidying settings.

Method Path DELETE /auth/aws/config/tidy/identity-accesslist Sample request 
$ curl \
    --header "X-Vault-Token: ..." \
    --request DELETE \
    http://127.0.0.1:8200/v1/auth/aws/config/tidy/identity-accesslist

Configures the periodic tidying operation of the deny listed role tag entries.

Method Path POST /auth/aws/config/tidy/roletag-denylist Parameters Sample payload 
{
  "safety_buffer": "48h"
}
Sample request 
$ curl \
    --header "X-Vault-Token: ..." \
    --request POST \
    --data @payload.json \
    http://127.0.0.1:8200/v1/auth/aws/config/tidy/roletag-denylist

Returns the previously configured periodic deny list tidying settings.

Method Path GET /auth/aws/config/tidy/roletag-denylist Sample request 
$ curl \
    --header "X-Vault-Token: ..." \
    http://127.0.0.1:8200/v1/auth/aws/config/tidy/roletag-denylist
Sample response 
{
  "data": {
    "safety_buffer": 600,
    "disable_periodic_tidy": false
  }
}

Deletes the previously configured periodic deny list tidying settings.

Method Path DELETE /auth/aws/config/tidy/roletag-denylist Sample request 
$ curl \
    --header "X-Vault-Token: ..." \
    --request DELETE \
    http://127.0.0.1:8200/v1/auth/aws/config/tidy/roletag-denylist

Registers a role in the method. Only those instances or principals which are using the role registered using this endpoint, will be able to perform the login operation. Constraints can be specified on the role, that are applied on the instances or principals attempting to login. At least one constraint must be specified on the role. The available constraints you can choose are dependent on the auth_type of the role and, if the auth_type is iam, then whether inferencing is enabled. A role will not let you configure a constraint if it is not checked by the auth_type and inferencing configuration of that role. For the constraints which accept a list of values, the authenticating instance/principal must match any one value in the list in order to satisfy that constraint.

Method Path POST /auth/aws/role/:role Parameters Sample payload 
{
  "bound_ami_id": ["ami-fce36987"],
  "bound_ec2_instance_id": ["i-12345678901234567"],
  "role_tag": "",
  "policies": ["default", "dev", "prod"],
  "max_ttl": 1800000,
  "disallow_reauthentication": false,
  "allow_instance_migration": false
}
Sample request 
$ curl \
    --header "X-Vault-Token: ..." \
    --request POST \
    --data @payload.json \
    http://127.0.0.1:8200/v1/auth/aws/role/dev-role

Returns the previously registered role configuration.

Method Path GET /auth/aws/role/:role Parameters Sample request 
$ curl \
    --header "X-Vault-Token: ..." \
    http://127.0.0.1:8200/v1/auth/aws/role/dev-role
Sample response 
{
  "data": {
    "bound_ami_id": ["ami-fce36987"],
    "role_tag": "",
    "policies": ["default", "dev", "prod"],
    "max_ttl": 1800000,
    "disallow_reauthentication": false,
    "allow_instance_migration": false
  }
}

Lists all the roles that are registered with the method.

Method Path LIST /auth/aws/roles Sample request 
$ curl \
    --header "X-Vault-Token: ..." \
    --request LIST \
    http://127.0.0.1:8200/v1/auth/aws/roles
Sample response 
{
  "data": {
    "keys": ["dev-role", "prod-role"]
  }
}

Deletes the previously registered role.

Method Path DELETE /auth/aws/role/:role Parameters Sample request 
$ curl \
    --header "X-Vault-Token: ..." \
    --request DELETE \
    http://127.0.0.1:8200/v1/auth/aws/role/dev-role

Creates a role tag on the role, which help in restricting the capabilities that are set on the role. Role tags are not tied to any specific ec2 instance unless specified explicitly using the instance_id parameter. By default, role tags are designed to be used across all instances that satisfies the constraints on the role. Regardless of which instances have role tags on them, capabilities defined in a role tag must be a strict subset of the given role's capabilities. Note that, since adding and removing a tag is often a widely distributed privilege, care needs to be taken to ensure that the instances are attached with correct tags to not let them gain more privileges than what were intended. If a role tag is changed, the capabilities inherited by the instance will be those defined on the new role tag. Since those must be a subset of the role capabilities, the role should never provide more capabilities than any given instance can be allowed to gain in a worst-case scenario.

Method Path POST /auth/aws/role/:role/tag Parameters Sample payload 
{
  "policies": ["default", "dev-api"]
}
Sample request 
$ curl \
    --header "X-Vault-Token: ..." \
    --request POST \
    --data @payload.json \
    http://127.0.0.1:8200/v1/auth/aws/role/dev-api-and-web-role/tag
Sample response 
{
  "data": {
    "tag_value": "v1:09Vp0qGuyB8=:r=dev-role:p=default,dev-api:d=false:t=300h0m0s:uPLKCQxqsefRhrp1qmVa1wsQVUXXJG8UZP/pJIdVyOI=",
    "tag_key": "VaultRole"
  }
}

Fetch a token. This endpoint verifies the PKCS#7 signature of the instance identity document or the signature of the signed GetCallerIdentity request. With the ec2 auth method, or when inferring an EC2 instance, verifies that the instance is actually in a running state. Cross checks the constraints defined on the role with which the login is being performed. With the ec2 auth method, as an alternative to PKCS#7 signature, the identity document along with its RSA signature can be supplied to this endpoint.

See the AWS docs for more information on the signature types.

Method Path POST /auth/aws/login Parameters Sample payload 
{
  "iam_http_request_method": "POST",
  "iam_request_body": "QWN0aW9uPUdldENhbG...",
  "iam_request_headers": "eyJBdXRob3JpemF0aW9uIj...",
  "iam_request_url": "aHR0cHM6L...",
  "role": "dev-role"
}
Sample request 
$ curl \
    --request POST \
    --data @payload.json \
    http://127.0.0.1:8200/v1/auth/aws/login
Sample response 
{
  "auth": {
    "renewable": true,
    "lease_duration": 1800000,
    "metadata": {
      "role_tag_max_ttl": "0",
      "instance_id": "i-de0f1344",
      "ami_id": "ami-fce36983",
      "role": "dev-role",
      "auth_type": "ec2"
    },
    "policies": ["default", "dev"],
    "accessor": "20b89871-e6f2-1160-fb29-31c2f6d4645e",
    "client_token": "c9368254-3f21-aded-8a6f-7c818e81b17a"
  }
}

Places a valid role tag in a deny list. This ensures that the role tag cannot be used by any instance to perform a login operation again. Note that if the role tag was previously used to perform a successful login, placing the tag in the deny list does not invalidate the already issued token.

Method Path POST /auth/aws/roletag-denylist/:role_tag Parameters Sample request 
$ curl \
    --header "X-Vault-Token: ..." \
    --request POST \
    http://127.0.0.1:8200/v1/auth/aws/roletag-denylist/djE6MDlWcDBxR3V5Qjg9OmE9YW1pLWZjZTNjNjk2OnA9ZGVmYXVsdCxwcm9kOmQ9ZmFsc2U6dD0zMDBoMG0wczp1UExLQ1F4cXNlZlJocnAxcW1WYTF3c1FWVVhYSkc4VVpQLwo=
Read role tag deny list information

Returns the deny list entry of a previously deny listed role tag.

Method Path GET /auth/aws/roletag-denylist/:role_tag Parameters Sample request 
$ curl \
    --header "X-Vault-Token: ..." \
    http://127.0.0.1:8200/v1/auth/aws/roletag-denylist/djE6MDlWcDBxR3V5Qjg9OmE9YW1pLWZjZTNjNjk2OnA9ZGVmYXVsdCxwcm9kOmQ9ZmFsc2U6dD0zMDBoMG0wczp1UExLQ1F4cXNlZlJocnAxcW1WYTF3c1FWVVhYSkc4VVpQLwo=
Sample response 
{
  "data": {
    "expiration_time": "2016-04-25T10:35:20.127058773-04:00",
    "creation_time": "2016-04-12T22:35:01.178348124-04:00"
  }
}

Lists all the role tags that are deny listed.

Method Path LIST /auth/aws/roletag-denylist Sample request 
$ curl \
    --header "X-Vault-Token: ..." \
    --request LIST \
    http://127.0.0.1:8200/v1/auth/aws/roletag-denylist
Sample response 
{
  "data": {
    "keys": [
      "v1:09Vp0qGuyB8=:a=ami-fce3c696:p=default,prod:d=false:t=300h0m0s:uPLKCQxqsefRhrp1qmVa1wsQVUXXJG8UZP/"
    ]
  }
}

Deletes a deny listed role tag.

Method Path DELETE /auth/aws/roletag-denylist/:role_tag Parameters Sample request 
$ curl \
    --header "X-Vault-Token: ..." \
    --request DELETE \
    http://127.0.0.1:8200/v1/auth/aws/roletag-denylist/djE6MDlWcDBxR3V5Qjg9OmE9YW1pLWZjZTNjNjk2OnA9ZGVmYXVsdCxwcm9kOmQ9ZmFsc2U6dD0zMDBoMG0wczp1UExLQ1F4cXNlZlJocnAxcW1WYTF3c1FWVVhYSkc4VVpQLwo=

Cleans up the entries in the deny listed based on expiration time on the entry and safety_buffer.

Method Path POST /auth/aws/tidy/roletag-denylist Parameters Sample request 
$ curl \
    --header "X-Vault-Token: ..." \
    --request POST \
    http://127.0.0.1:8200/v1/auth/aws/tidy/roletag-denylist
Read identity access list information

Returns an entry in the identity access list. An entry will be created/updated by every successful login.

Method Path GET /auth/aws/identity-accesslist/:instance_id Parameters Sample request 
$ curl \
    --header "X-Vault-Token: ..." \
    http://127.0.0.1:8200/v1/auth/aws/identity-accesslist/i-aab47d37
Sample response 
{
  "data": {
    "pending_time": "2016-04-14T01:01:41Z",
    "expiration_time": "2016-05-05 10:09:16.67077232 +0000 UTC",
    "creation_time": "2016-04-14 14:09:16.67077232 +0000 UTC",
    "client_nonce": "5defbf9e-a8f9-3063-bdfc-54b7a42a1f95",
    "role": "dev-role"
  }
}

Lists all the instance IDs that are in the access list of successful logins.

Method Path LIST /auth/aws/identity-accesslist Sample request 
$ curl \
    --header "X-Vault-Token: ..." \
    --request LIST \
    http://127.0.0.1:8200/v1/auth/aws/identity-accesslist
Sample response 
{
  "data": {
    "keys": ["i-aab47d37"]
  }
}

Deletes a cache of the successful login from an instance.

Method Path DELETE /auth/aws/identity-accesslist/:instance_id Parameters Sample request 
$ curl \
    --header "X-Vault-Token: ..." \
    --request DELETE \
    http://127.0.0.1:8200/v1/auth/aws/identity-accesslist/i-aab47d37

Cleans up the entries in the access list based on expiration time and safety_buffer.

Method Path POST /auth/aws/tidy/identity-accesslist Parameters Sample request 
$ curl \
    --header "X-Vault-Token: ..." \
    --request POST \
    http://127.0.0.1:8200/v1/auth/aws/tidy/identity-accesslist

Vault 1.7 introduced new URLs for a number of AWS Auth APIs. The previous URLs are deprecated. The affected APIs include:

Current Deprecated in 1.7 /auth/aws/roletag-denylist /auth/aws/roletag-blacklist /auth/aws/identity-accesslist /auth/aws/identity-whitelist /auth/aws/tidy/identity-accesslist /auth/aws/tidy/identity-whitelist /auth/aws/tidy/roletag-denylist /auth/aws/tidy/roletag-blacklist /auth/aws/config/tidy/identity-accesslist /auth/aws/config/tidy/identity-whitelist /auth/aws/config/tidy/roletag-denylist /auth/aws/config/tidy/roletag-blacklist

RetroSearch is an open source project built by @garambo | Open a GitHub Issue

Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo

HTML: 3.2 | Encoding: UTF-8 | Version: 0.7.4