How to Configure a Role Trust for Instance or Bare Metal

A role trust for a Vultr Cloud Compute instance or Bare Metal server trusts the entity's identity token instead of a specific user, group, or OIDC issuer. Set trusted_oidc_issuer_source to instance or baremetal instead of trusted_user_id, trusted_group_id, or trusted_oidc_issuer_id. Vultr automatically provisions a singleton OIDC issuer for that source on your account the first time you create a trust against it, and pins the trust's conditions.oidc_claims.acctid to your account automatically. You never need to look up or supply your account's numeric ID yourself.

Follow this guide to configure a role trust for instance or bare metal identity tokens using the Vultr API.

1. Send a GET request to the List Roles endpoint to retrieve all roles in your organization.

   CONSOLE

   Copy

   $ curl "https://api.vultr.com/v2/roles" \
       -X GET \
       -H "Authorization: Bearer ${VULTR_API_KEY}"

   Explain Code

   Powered by Vultr AgentBeta

   Note the id of the assumable role for which you want to create a trust.

2. Send a POST request to the Create Role Trust endpoint to create the trust relationship. Replace ROLE-ID with the assumable role id, and set trusted_oidc_issuer_source to instance or baremetal depending on the resource type that should assume the role. Omit conditions, since Vultr fills in the account pin automatically.

   CONSOLE

   Copy

   $ curl "https://api.vultr.com/v2/role-trusts" \
       -X POST \
       -H "Authorization: Bearer ${VULTR_API_KEY}" \
       -H "Content-Type: application/json" \
       -d '{
           "role_id": "ROLE-ID",
           "trust_type": "TemporaryAssumption",
           "trusted_oidc_issuer_source": "instance"
       }'

   Explain Code

   Powered by Vultr AgentBeta

   A successful request returns an HTTP 201 Created response. Note the id of the role trust for future operations.

3. Send a GET request to the Read Role Trust endpoint to retrieve the trust details. Replace {role-trust-id} with the id returned from the creation request.

   CONSOLE

   Copy

   $ curl "https://api.vultr.com/v2/role-trusts/{role-trust-id}" \
       -X GET \
       -H "Authorization: Bearer ${VULTR_API_KEY}"

   Explain Code

   Powered by Vultr AgentBeta

   Verify that conditions.oidc_claims.acctid shows your account's numeric ID, filled in automatically.

Once the trust exists, any instance or bare metal server on your account can assume the role with its identity token. See How to Create a Role Trust for background on trust types and conditions.