ckets).

s3:ListBucket

s3:GetObject

s3:PutObjects3:DeleteObject

s3:ListAllMyBuckets

If set, the resource name must identify an S3 bucket using one of the following

formats:

S3 bucket URI (canonical resource name): s3://{bucket-name}

S3 bucket ARN: arn:aws:s3:::{bucket-name}

S3 bucket name: {bucket-name}

────────────────────────────────────────────────────────────────────────────────

Dashboard equivalent:

Displaying information about the AWS Session Token authentication method:

zenml service-connector describe-type aws --auth-method session-token

Example Command Output

╔══════════════════════════════════════════════════════════════════════════════╗

║              🔒 AWS Session Token (auth method: session-token)               ║

╚══════════════════════════════════════════════════════════════════════════════╝

Supports issuing temporary credentials: True

Generates temporary session STS tokens for IAM users. The connector needs to be

configured with an AWS secret key associated with an IAM user or AWS account

root user (not recommended). The connector will generate temporary STS tokens

upon request by calling the GetSessionToken STS API.

These STS tokens have an expiration period longer that those issued through the

AWS IAM Role authentication method and are more suitable for long-running

processes that cannot automatically re-generate credentials upon expiration.

An AWS region is required and the connector may only be used to access AWS

resources in the specified region.

The default expiration period for generated STS tokens is 12 hours with a

minimum of 15 minutes and a maximum of 36 hours. Temporary credentials obtained

by using the AWS account root user credentials (not recommended) have a maximum

duration of 1 hour.

As a precaution, when long-lived credentials (i.e. AWS Secret Keys) are detected

on your environment by the Service Connector during auto-configuration, this

authentication method is automatically chosen instead of the AWS Secret Key

authentication method alternative.