Security, Identity, and Compliance
CoreAWS Security Token Service (AWS STS)
Service that issues temporary AWS security credentials for authorized role and federation sessions.
Key points
- AssumeRole requires caller permission and an accepting role trust relationship.
- Returned credentials are temporary and represent the assumed role session.
- Session context and conditions can further constrain access.
Best-known use cases
- Temporary cross-account role access.
- Delegated workload or federated AWS sessions.
What candidates often confuse it with
- STS issues temporary AWS credentials; Cognito user pools issue application-user tokens.
- Assuming a role changes the operating principal; a resource policy can authorize a caller that retains its identity.
Key takeaway
Use STS for temporary AWS principal sessions and configure both the request permission and target trust.
Related services
- AWS Identity and Access Management (IAM)
- Amazon Cognito
- AWS Key Management Service (AWS KMS)
Relevant exam tasks
- D2.1 — Implement authentication and/or authorization for applications and AWS services
- 2.1.3 — Configure programmatic access to AWS
- 2.1.4 — Make authenticated calls to AWS services
- 2.1.5 — Assume an IAM role
- 2.1.8 — Handle cross-service authentication in microservice architectures