STS

Question 1

Which AWS service allows users to request temporary, limited-privilege credentials?

Answer 1

AWS Security Token Service (STS)

Question 2

What is the primary functionality of AWS STS?

Answer 2

To generate temporary credentials when the sts:AssumeRole* operation is used

Question 3

What pieces of credentials does AWS STS provide?

Answer 3

• AccessKeyID
• SecretAccessKey
• SessionToken (required for requests)
• Expiration (the date when credentials expire)

Question 4

What are the credentials generated by AWS STS used for?

Answer 4

To temporarily access AWS resources

Question 5

Do AWS STS credentials belong to the identity that uses them?

Answer 5

No, these credentials do not belong to the identity and have a configurable expiration period ranging from 15 minutes to a maximum of 12 hours

Question 6

Who can request credentials using AWS STS?

Answer 6

Any identity (AWS or external) that has permissions for sts:AssumeRole* and is defined as a principal in the role’s trust policy

Question 7

What permissions can an identity gain by generating credentials with AWS STS?

Answer 7

The permissions that are defined in the role’s permissions policy

Question 8

How can an identity refresh the expired credentials provided by AWS STS?

Answer 8

By performing another sts:AssumeRole* operation to generate new credentials