STS Flashcards
What is STS?
Security Token Service is a web service that enables you to request temporary, limited-privilege credentials for IAM users or for users that you authenticate (federated users)
What is the STS token valid time?
from 15 minutes and up to 1 hour, but can be refreshed
What are most important STS API operations?
- AssumeRole
- AssumeRoleWithSAML
- AssumeRoleWithWebIdentity
- GetSessionToken
- GetFederationToken
- GetCallerIdentity
- DecodeAuthorizationMessage
What is STS AssumeRole operation?
- Within your own account: for enhanced security
* Cross Account Access: assume role in target account to perform actions there
What is STS AssumeRoleWithSAML operation?
return credentials for users logged with SAML
What is STS AssumeRoleWithWebIdentity operation?
- return creds for users logged with an IdP (Facebook Login, Google Login, OIDC compatible…)
- AWS recommends against using this, and using Cognito instead
What is STS GetSessionToken operation?
for MFA, from a user or AWS account root user
How does work STS to Assume a Role?
1- Define an IAM Role within your account or cross-account
2- Define which principals can access this IAM Role
3- Use STS to retrieve credentials and impersonate the IAM Role you have access to (AssumeRole API)
What is STS GetFederationToken operation?
obtain temporary creds for a federated user
What is STS GetCallerIdentity operation?
return details about the IAM user or role used in the API call
What is STS DecodeAuthorizationMessage operation?
decode error message when an AWS API is denied
When you must use STS GetSessionToken API?
When the policy includes a condition saying aws:MultiFactorAuthPresent:true
