How STS Issues Temporary Credentials

The Security Token Service (STS) is the AWS service that issues temporary security credentials. Every time a role is assumed or an identity is federated, STS hands out short-lived credentials instead of permanent keys. Understanding STS is central to the exam because temporary credentials underpin nearly all secure access patterns on AWS.

STS credentials consist of three parts: an access key ID, a secret access key, and a session token. The session token is what distinguishes them from long-term keys; it must accompany every signed request. All three expire together after a defined lifetime, making the credentials self-limiting.

Because they expire automatically (from 15 minutes to 12 hours), temporary credentials sharply limit the damage from a leak. There are no keys to rotate manually and nothing permanent to steal. This is why AWS recommends temporary credentials over long-term access keys almost everywhere, a point the exam reinforces repeatedly.

STS exposes a handful of operations:

• AssumeRole — assume a role in the same or another account.
• AssumeRoleWithSAML — federate via a SAML identity provider.
• AssumeRoleWithWebIdentity — federate via OIDC/web identity.
• GetSessionToken / GetFederationToken — for MFA and IAM-user federation.

The most common call is AssumeRole. The caller, already authenticated, requests a role; STS verifies the role's trust policy permits the caller, then returns temporary credentials carrying the role's permissions. The caller uses them until they expire, then assumes the role again to refresh.

This CLI call assumes a role and returns temporary credentials. The role ARN and a session name are required; the session name appears in CloudTrail for auditing.

STS historically used a single global endpoint, but AWS now offers regional STS endpoints. Using the regional endpoint reduces latency and improves resilience, and some compliance setups require it. Newer regions are not reachable through the global endpoint, so enabling regional STS is a recommended configuration.

The GetCallerIdentity operation returns the account, user ID, and ARN of whoever is making the call. It needs no special permissions and is the go-to way to confirm which identity your credentials currently represent, useful when debugging assumed-role sessions during an investigation.

Every STS call is logged in CloudTrail, including who assumed which role and the session name they chose. This trail lets investigators trace exactly which human or service obtained temporary credentials and what they then did. Meaningful session names make this audit far more useful.

Applications using temporary credentials must send the session token with each request; the AWS SDK and CLI do this automatically once configured. If you ever see authentication failures with temporary credentials, a missing or mismatched session token is a frequent cause to check.

STS is the engine behind roles and federation: it issues short-lived access key, secret, and session token sets that expire on their own, vastly safer than permanent keys. Use AssumeRole family operations, prefer regional endpoints, give sessions meaningful names for CloudTrail, and let temporary credentials replace long-term ones wherever you can.

Test your STS basics.

The Security Token Service (STS) issues temporary credentials: an access key, secret, and session token that expire after 15 minutes to 12 hours. Core APIs include AssumeRole, AssumeRoleWithSAML, and AssumeRoleWithWebIdentity. Prefer regional endpoints, use meaningful session names for CloudTrail, and replace long-term keys with temporary ones.