AWS Security Token Service (STS)

AWS Security Token Service (STS) is a service of Amazon Web Services that lets AWS users access AWS services by using temporary security credentials.

Key points

• Issues temporary, limited-privilege credentials for authentication with other AWS APIs.
• Underpins AWS Identity and Access Management (IAM) role assumption, letting IAM roles hand out short-lived credentials instead of long-lived access keys.
• Used by Amazon Cognito identity pools to exchange authentication tokens for temporary AWS credentials.
• Core API actions: AssumeRole, AssumeRoleWithWebIdentity, AssumeRoleWithSAML, GetFederationToken, and GetSessionToken — each issues temporary credentials for a different trust scenario (IAM role switching, web/OIDC identity, SAML federation, IAM user federation, and IAM user self-service, respectively). Also includes GetCallerIdentity, GetAccessKeyInfo, and DecodeAuthorizationMessage for inspecting credentials, plus the newer AssumeRoot for short-lived, task-scoped root access into AWS Organizations member accounts.
• A global service by default, with a single endpoint at sts.amazonaws.com. In Regions enabled by default, requests to this global endpoint are now automatically served from the local Region rather than always being routed to US East (N. Virginia) as before; opt-in Regions and non-Amazon DNS (Domain Name System) resolvers still fall back to US East (N. Virginia). AWS recommends using regional STS endpoints directly for lower latency and improved resiliency.

Sources

• Actions - AWS Security Token Service
• AWS STS Regions and endpoints