Security Token Service

• A service that provides temporary security credentials.

• These credentials are generated when sts:AssumeRole is called.

---

🔄 Assuming a Role

• When an identity (user, application, external entity) calls sts:AssumeRole, AWS returns:

  • Temporary credentials (Access Key ID, Secret Access Key, Session Token).

• These credentials:

  • Are short-lived (expire after a set time).

  • Do not belong to the identity using them.

---

✅ Access Control

• The access from these credentials is based on the role's permissions policy.

• Can be further restricted to a subset of those permissions.

• Ensures least privilege access is possible even when assuming powerful roles.

---

☁️ Where Temporary Credentials Can Be Used

• Can be used to access AWS resources just like permanent credentials.

• Especially useful for:

  • Cross-account access

  • Federated users

  • Applications needing short-term access

---

🧠 Quick Summary

Feature	Description
Service	AWS STS (Security Token Service)
Main operation	sts:AssumeRole
Output	Temporary credentials
Lifetime	Short-lived (e.g., 15 min to a few hours)
Belongs to	The role, not the calling identity
Access control	Controlled by the role's policy, and can be further limited
Use cases	Temporary access, cross-account roles, identity federation

Revoking Temporary Credentials