AWS STS
Issues temporary, limited-privilege credentials so nobody has to hold long-term keys.
Verified against AWS documentation · 2026-08-28
Key facts
- 01Returns three things: access key ID, secret access key, session token — all requests using them must include the session token
- 02AssumeRole: default 1 hour, up to 12 hours depending on the role's max session duration setting
- 03Role chaining (assumed role assumes another role) is hard-capped at 1 hour — not configurable
- 04Once issued, credentials cannot be revoked — but permissions are re-evaluated on every request, so changing the role's policy effectively cuts them off
- 05Global endpoint (sts.amazonaws.com) by default; regional endpoints exist and AWS recommends them for lower latency and resilience
- 06Temporary access keys start with ASIA; long-term IAM user keys start with AKIA
Exam triggers
Phrases and scenarios that point here.
- "Temporary credentials", "short-lived access", "no long-term keys" → STS
- Cross-account access → role in target account + AssumeRole, never a duplicate IAM user
- Corporate directory / SAML login to AWS → AssumeRoleWithSAML
- Mobile app users via Google/Facebook/Cognito → AssumeRoleWithWebIdentity
- Third party assuming a role in your account → require ExternalId (confused deputy defense)
- "Who am I authenticated as?" in a script → GetCallerIdentity
Not this service
- Defining users, roles, and policies themselves → IAM (STS only vends credentials against them)
- Full user directory with sign-up/sign-in for your app → Amazon Cognito
- Centralized workforce access across many accounts → IAM Identity Center
Use cases
- 01Cross-account access: an auditor or partner assumes a role in your account instead of you creating and babysitting an IAM user for them — like a visitor badge that expires at the end of the day
- 02CI/CD pipelines (Jenkins, GitHub Actions) assuming a deploy role per run, so no permanent keys sit in pipeline config waiting to leak
- 03EC2 instance profiles, ECS task roles, and Lambda execution roles — all of these are STS under the hood, auto-refreshing credentials so your code never touches a key file
- 04Federating an existing corporate directory into AWS via SAML, so employees use one login and zero IAM users get created
- 05MFA-protected CLI sessions: GetSessionToken with an MFA code before sensitive operations
How it's charged
- 01STS itself is free — no charge for any API operation or issued credential
- 02Costs show up indirectly: the services accessed with the credentials bill as normal
- 03Watch for throttling, not billing — STS API calls have per-Region rate quotas, and credential-refresh storms in large fleets can hit them
