Latest Content

How to Create a Role Trust

Updated on 08 April, 2026

Create a role trust in Vultr IAM to define who can assume a specific role. Configure trust relationships for users, groups, organizations, or OIDC issuers.

A role trust defines who is allowed to assume a specific role and under what conditions. Before creating a role trust, you must first create an assumable role. The trust relationship links the role to a trusted entity — a user, a group, or an OIDC issuer — and can include conditions such as IP restrictions, time-of-day limits, and an expiration date.

There are three trust types:

  • TemporaryAssumption: The trusted entity must explicitly call the assume-role endpoint to activate the role. The created session becomes the principal.
  • IAMAssumption: The role is assumed automatically through OIDC inline validation. The actual platform user remains the principal.
  • FederatedAssumption: The role is assumed automatically through OIDC inline validation. The role itself determines the principal, not a platform user.

This guide explains how to create a role trust using the Vultr Console and the Vultr API.

  • Vultr Console
  • Vultr API

A role trust is created as part of the assumable role creation flow.

  1. Log in to the Vultr Console.

  2. Click the organization name in the top navigation bar.

  3. Click Manage Organization.

  4. Click the Roles tab.

  5. Click the + button to add a new role.

  6. Select Assumable Role.

  7. Enter a Name and optional Description for the role.

  8. Under Trusted Entity, select the entity type (User, Group, or OIDC Issuer) and choose the specific entity from the dropdown.

  9. Configure the assumption schedule:

    • Always assumable: No time restrictions.
    • Assumable at specific times of the day: Restrict assumption to a specific time window by setting start and end times with a timezone for granular control.
    • Assumable on specific days of the week: Select the allowed days of the week.
    • Assumable on specific days of the week, at specific times of the day: Combine day and time restrictions for the most granular control.

  10. (Optional) Under IP Access Restrictions, enter one or more allowed IP addresses (IPv4 or IPv6) to restrict role assumption to specific source IPs.

  11. In the Permission Policies section, search for and select the policies to attach.

  12. Click Add Role.

    The assumable role is created with the trust relationship configured. To view the trust details, click the role name and expand the Role Trust section.

  1. Send a GET request to the List Roles endpoint to retrieve all roles in your organization.

    console 
    $ curl "https://api.vultr.com/v2/roles" \
    -X GET \
    -H "Authorization: Bearer ${VULTR_API_KEY}"

    Note the id of the assumable role for which you want to create a trust.

  2. Identify the trusted entity. You need either a user_id, group_id, or oidc_issuer_id depending on who should be allowed to assume the role.

  3. Send a POST request to the Create Role Trust endpoint to create the trust relationship. Replace ROLE-ID with the assumable role id and USER-ID with the trusted user id. Use trusted_group_id or trusted_oidc_issuer_id instead of trusted_user_id if trusting a group or OIDC issuer. Adjust the conditions and valid_until fields as needed. Add allowed source IPs to the ip_address array to restrict role assumption to specific IPv4 or IPv6 addresses. Leave the array empty to allow all IPs.

    console 
    $ curl "https://api.vultr.com/v2/role-trusts" \
    -X POST \
    -H "Authorization: Bearer ${VULTR_API_KEY}" \
    -H "Content-Type: application/json" \
    -d '{
        "role_id": "ROLE-ID",
        "trust_type": "IAMAssumption",
        "trusted_user_id": "USER-ID",
        "conditions": {
            "time_of_day": {
                "timezone": "utc",
                "days_of_week": ["monday", "tuesday", "wednesday", "thursday", "friday"]
            },
            "ip_address": ["203.0.113.10", "2001:db8::1"]
        },
        "valid_until": "2026-06-20T03:59:59+00:00"
    }'

    A successful request returns an HTTP 201 Created response.

    Note the id of the role trust for future operations.

  4. Send a GET request to the Read Role Trust endpoint to retrieve the trust details. Replace {role-trust-id} with the id returned from the creation request.

    console 
    $ curl "https://api.vultr.com/v2/role-trusts/{role-trust-id}" \
    -X GET \
    -H "Authorization: Bearer ${VULTR_API_KEY}"

    The response contains the resource details.

Comments