Antony Tran

AWS Security Token Service (STS)

What is AWS Security Token Service (STS)?

AWS Security Token Service (STS) is a web service that enables you to request temporary, limited-privilege credentials for AWS Identity and Access Management (IAM) users or for users that you authenticate (federated users). These temporary credentials are primarily used in scenarios where long-term credentials are not desirable due to security concerns.

Key APIs of AWS STS

AWS STS provides several APIs that enable various functionalities around temporary credentials. Here’s a closer look at some of the most critical STS APIs:

  1. AssumeRole: Allows IAM users to assume a role within your AWS account or a third party and receive temporary credentials to access AWS services. This API is useful for accessing resources that require different permissions than those you regularly have.

  2. AssumeRoleWithSAML: Returns security credentials when given a valid SAML authentication response. This allows federation of SAML-enabled identities, making it easy to manage access to AWS resources across a corporate environment.

  3. AssumeRoleWithWebIdentity: Returns a set of temporary security credentials for users who have been authenticated via a mobile or web application with a web identity provider like Amazon Cognito, Facebook, Google, or any OpenID Connect-compatible identity provider.

  4. GetSessionToken: Provides a way to fetch credentials for users that are already authenticated by IAM. This API is used primarily for enhancing security with MFA, enabling you to enforce MFA authentication for accessing sensitive resources.

  5. GetFederationToken: Issues temporary credentials for a federated user with a custom policy defining the permissions for the session. This is useful for creating a session that has restricted permissions that might not necessarily match those of the IAM user.

  6. GetCallerIdentity: Allows retrieval of the AWS account number, IAM user or role name, and other identity-related details for the entity making the call. This is helpful for environments where you need to confirm the identity of the caller before granting access to resources.

Benefits of Using AWS STS

  • Enhanced Security: By providing temporary credentials, AWS STS minimizes the risks associated with long-term credential exposure.
  • Scalable Access Management: It facilitates easier and more secure access management for applications that need to access AWS resources.
  • Flexibility: Offers flexible access control for both AWS services and custom applications, accommodating various scenarios from enterprise SSO to mobile app user authentication.

Conclusion

AWS Security Token Service (STS) is an indispensable tool for managing temporary access to AWS resources, providing security and flexibility where it's needed most. Whether for internal users within an AWS account or federated users across corporate boundaries, STS ensures that access is secure, temporary, and appropriately scoped to the needs of the user and application.

Using AWS STS effectively can help safeguard your AWS environment against credential leakage and ensure that your access control policies are both robust and adaptable.