📡 You're offline — showing cached content
⚡ New version available!
Quick Access
🗺️ Roadmaps 🃏 Flashcards 📚 Series 🎓 Tutorials 🗺️ My Path 🎤 Mock Interview ⚡ Cheat Code 📄 Resume Builder 🛠️ Dev Tools
Tutorials › AWS Solutions Architect › STS and Temporary Credentials

STS and Temporary Credentials

4 min read
Understand STS temporary credentials, cross-account role assumption, and why temporary credentials are more secure than long-term access keys.

STS — Security Token Service

STS issues temporary security credentials (access key + secret key + session token) that expire after a set time. Temporary credentials are more secure than long-term access keys because they automatically become invalid.

Teacher Note: Long-term access keys are like a physical key to your house — if someone steals it, they have permanent access until you change the locks. Temporary credentials are like a one-day visitor badge — if stolen, it expires in hours and becomes worthless automatically.

Key STS Operations

OperationUsed ByDuration
AssumeRoleServices, cross-account access, federated users15 min to 12 hours
AssumeRoleWithWebIdentityApps using Cognito, Google, Facebook login1 hour
AssumeRoleWithSAMLEnterprise SSO (Active Directory)1 hour
GetSessionTokenIAM users adding MFA to temporary credentials15 min to 36 hours

Cross-Account Role Assumption

# Account A (trusting account) creates a role:
# Trust Policy: "Allow Account B to assume this role"
{
  "Principal": {"AWS": "arn:aws:iam::ACCOUNT_B_ID:root"},
  "Action": "sts:AssumeRole"
}

# Account B user assumes the role:
aws sts assume-role 
  --role-arn "arn:aws:iam::ACCOUNT_A_ID:role/CrossAccountRole" 
  --role-session-name "MySession"

# Returns temporary credentials:
# AccessKeyId, SecretAccessKey, SessionToken (expires in 1 hour)

# Use them:
export AWS_ACCESS_KEY_ID=ASIA...
export AWS_SECRET_ACCESS_KEY=...
export AWS_SESSION_TOKEN=...
Exam Tip: When you assume an IAM Role, STS gives you temporary credentials valid for the configured duration (up to 12 hours). After expiry, the credentials stop working — the application must re-assume the role. AWS SDK handles this automatically when using IAM Roles on EC2 and Lambda.