AWS Security Token Service (STS)

AWS Security Token Service (STS) issues temporary, limited-privilege credentials — for IAM principals, for federated users, and for AWS services acting on your behalf. Every role assumption, every federated sign-in and every instance profile goes through it.

graph TD A[User, application or AWS service] -->|1. Request temporary credentials| B[AWS STS] B -->|2. Return access key ID, secret access key, session token| A A -->|3. Call AWS services with those credentials| C[AWS services] D[IAM role] -->|Trust policy: who may assume<br/>Permission policy: what the session may do| B E[External identity provider] -->|SAML assertion or OIDC token| B F[MFA] -->|Optional additional condition| B style B fill:#ff9900,stroke:#000000,stroke-width:2px style C fill:#d86613,stroke:#000000,stroke-width:2px

Key properties

• Temporary. Credentials expire at a defined time, so there is nothing to rotate and nothing worth stealing for long.
• Limited privilege. A session can hold fewer permissions than the principal that requested it, through the role’s permission policy and optional session policies.
• No long-lived secrets. Nothing is stored on an instance, in a container image or in a configuration file.

Core operations

Operation	Used for
AssumeRole	Cross-account access, and any IAM principal switching into a role
AssumeRoleWithWebIdentity	OIDC federation — Amazon Cognito, Google, Facebook, Login with Amazon, GitHub Actions and any OIDC provider registered in the account
AssumeRoleWithSAML	SAML 2.0 federation, such as Active Directory Federation Services
GetSessionToken	Temporary credentials for an IAM user, typically to satisfy an MFA condition
GetFederationToken	A federated user session created from long-term IAM credentials. AWS recommends roles instead

Session duration

• AssumeRole sessions run from 15 minutes up to the role’s MaxSessionDuration, which can be set as high as 12 hours.
• Role chaining — assuming a role from an already-assumed role — is capped at one hour regardless of the role’s configured maximum.
• GetSessionToken sessions run from 15 minutes to 36 hours, with a default of 12 hours.

Shorter is better. The duration is the window in which a leaked session is useful.

Components involved

• IAM roles carry the permission policy that defines what a session may do.
• Trust policies on the role define who may assume it: an account, a specific role or user, an AWS service principal, or a federated identity provider. An EC2 instance ARN is not a valid principal — an instance obtains credentials through an instance profile, not by being named in a trust policy.
• Temporary security credentials consist of an access key ID, a secret access key and a session token. All three must be sent with each request.

Related services

• IAM defines the roles and policies that STS enforces.
• Amazon Cognito identity pools call STS to exchange a user pool token for AWS credentials.
• AWS Organizations provides the account structure that cross-account role assumption operates within, and the SCPs that bound what a session can do.

Practice

1. Use roles and STS rather than IAM users with access keys, in every case where it is possible — which is nearly all of them.
2. Apply least privilege to the role’s permission policy, and narrow further with session policies where a session needs less than the role.
3. Set the shortest session duration the workflow tolerates.
4. Use an external ID in the trust policy when granting a third party access, to prevent the confused deputy problem.
5. Log and monitor AssumeRole calls in CloudTrail; unusual role assumption is one of the clearest signals of a compromised credential.
6. Know how to revoke a session — attaching a deny policy conditioned on the session’s issue time — before it is needed.