Connect Alibaba Cloud STS to Your AI Agent

Specify the intended role and session requirements so the assistant can request credentials with an expiration time.

2 tools Federated

Try a Alibaba Cloud STS Task

Copy a prompt into your agent with the oo Skill installed. Add your page links and source notes before running it.

oo Skill Alibaba Cloud STS

Request a Role Session

Use a connected RAM identity to obtain temporary credentials for a specified role.

/oo Alibaba Cloud STS: Using my RAM AccessKey connection, assume role [role ARN] with session name [name] for [seconds]. Apply this optional session policy [policy or none] and report expiration without showing secret values.

Retrieve a Federated Session

Obtain the temporary credential set from the configured OIDC connection.

/oo Alibaba Cloud STS: Retrieve STS credentials from my configured OIDC federation connection and report the session expiration. Keep secret credential values out of the written summary.

Start Working with Alibaba Cloud STS

Install OOMOL

Set up oo CLI and the oo Skill in your agent.
Install OOMOL →
Connect Alibaba Cloud STS

Connect a RAM AccessKey pair for role assumption, or configure OIDC federation.
Connect Alibaba Cloud STS →
Give Your Agent a Task

Use /oo with the pages to read, the changes to make, and where to save the result.
Connection Guide →

Choose Your Agent

Codex Claude Code Cursor Hermes

A RAM principal authorized to assume the target role, or a trusted federated role configuration.
A root account AccessKey is not accepted for AssumeRole. Federated credentials follow the configured role and lease, rather than per-call policy changes.

Alibaba Cloud STS Tools

The connection exchanges RAM credentials for STS credentials or exposes a configured OIDC federated session. It does not create RAM roles or grant new permissions.

Temporary Role Sessions

Obtain credentials through RAM role assumption or an OIDC federated session.

2 tools

Assume Role

Use a connected Alibaba Cloud RAM AccessKey pair to call STS AssumeRole and return temporary credentials.

aliyun_sts.assume_role

Get Federated Credentials

Return Alibaba Cloud STS temporary credentials from the connected OOMOL OIDC federation configuration.

aliyun_sts.get_federated_credentials

Frequently Asked Questions

What does an STS session contain?

Temporary access credentials, a security token, and expiration information. Pass secrets only to the authorized tool that needs them.

Do I need to provide a role each time?

With a RAM connection, a saved default role can be used; otherwise provide the role ARN. Federation uses the role selected in its connection configuration.

Does STS grant permissions missing from the role?

No. Temporary sessions are constrained by the role and applicable policies. A session policy can further restrict role access rather than add permissions.