AWS Security Token Service (STS)
Temporary credentials
Issues temporary credentials (access key, secret, and a time-limited session token) through APIs such as AssumeRole, AssumeRoleWithWebIdentity, and GetSessionToken to access AWS without long-term keys.
- Cost$ Low
- Difficulty●●●●●
- Costs money when idle?No
- Serverless
- In examsSAA · DVA · SOA
Think of it asLike a visitor pass valid for the day that deactivates itself when time is up.
When to use it
✓ Use it when
Cross-account access, federation, or apps that need short-term credentials.
✗ Avoid it when
Storing third-party passwords/API keys → Secrets Manager.
Common uses
- AssumeRole into another account
- Federation from a SAML/OIDC IdP
- Require MFA for sensitive actions
What does it cost?
- Pricing model: Free.
When the question says cross-account access without long-term access keys, choose an IAM role with STS AssumeRole; for users from an enterprise IdP (SAML) signing in to AWS, choose federation with AssumeRoleWithSAML; for a mobile app with Google or Facebook login calling AWS, choose Cognito.
Frequently asked questions
Why use STS temporary credentials instead of IAM user access keys?
Temporary credentials expire on their own, so if leaked the damage is limited, while long-term access keys last until someone deletes them. That is why applications on AWS should use IAM roles (EC2, Lambda, ECS and others get credentials through STS automatically), and people should sign in through federation or IAM Identity Center.
When do I use AssumeRole and what must be configured?
AssumeRole lets a user or service take on the permissions of another role, most commonly for cross-account access. Both sides are needed: the role's trust policy must allow the caller, and the caller's identity policy must allow sts:AssumeRole. For third parties outside your organization, also use an external ID to avoid the confused deputy problem.
How does STS support federation with external identities?
AssumeRoleWithSAML is for enterprise IdPs (such as Active Directory through SAML), and AssumeRoleWithWebIdentity is for web identity logins such as Google or Facebook. For web and mobile apps, AWS recommends Amazon Cognito instead of calling these directly. All of them return temporary credentials with an expiry.
Related services
SAA-C03 study guide
STS is covered in these study modules: