AWS STS Temporary Credentials and AssumeRole Explained
STS is the counter that prints temporary AWS keys. You ask for a role; STS gives an access key, secret key and session token that die after a few minutes or hours.
What you'll learn in this chapter
- What STS is and why it exists
- AssumeRole and the three credential parts
- Duration and session name
- Who may call AssumeRole
- Why temp beats long-lived keys
1. Everyday example first
Why do we need this?
Zomato delivery partners get a one-shift unlock code for the bike locker — not the master key forever. STS is that unlock code for AWS APIs.
Company names here are for teaching only; the locker story is made up.
What is it?
AWS STS (Security Token Service) issues temporary security credentials. The most common API is AssumeRole: “Let me wear this role for N seconds.”
2. The three pieces
| Field | Meaning |
|---|---|
| AccessKeyId | Temporary ID (starts like ASIA… often) |
| SecretAccessKey | Temporary secret — treat like a password |
| SessionToken | Extra token required on every signed request |
| Expiration | ISO time when they stop working |
CLI and SDKs need all three when you use assumed-role credentials. Forgetting the session token is a common “InvalidClientTokenId” mistake.
3. Duration and naming
- Default max session is often 1 hour; you can request less. Role settings can allow up to 12 hours for some roles.
RoleSessionNameappears in CloudTrail — use a clear name likeravi-lab-2026.- Optional MFA and external ID harden cross-account AssumeRole.
4. Why temporary wins
- Leaked session dies at expiration. Leaked IAM user key can live for years.
- You can revoke by changing the role trust or permissions.
- CloudTrail shows who assumed what and when.
- EC2/Lambda instance profiles use STS under the hood automatically.
Ravindra Bagale's Tip
Never commit temporary keys to Git either. They are still secrets until Expiration. Prefer profiles and instance roles.
5. Interview angles
Q. What does STS return?
AccessKeyId, SecretAccessKey, SessionToken, Expiration.
Q. AssumeRole vs GetSessionToken?
AssumeRole switches to a role; GetSessionToken often upgrades the same user (e.g. MFA).
Q. Why session token?
AWS needs it to prove the creds came from STS.
Q. Who can AssumeRole?
Principals listed in the role trust policy (and their own IAM allows sts:AssumeRole).
Q. Max duration?
Depends on role and caller; commonly up to 1–12 hours.
Try at home
- Read AWS docs page title only: “Temporary security credentials in IAM” — then come back and do the next lab.
- Next chapter: AssumeRole with the CLI step by step.
In short
- STS mints temporary AWS credentials.
- AssumeRole returns key + secret + session token.
- Sessions expire — that is the safety.
- Prefer STS/roles over permanent user keys.
Practice Tasks
Latur Coaching Classes is a coaching business in Latur. Pooja Jadhav looks after its IT and cloud work. They count money in INR and run their AWS resources in the ap-south-1 Region. In the tasks below you do real jobs for them using what this lesson teaches. All names, account IDs, IP addresses and numbers are made up for practice.
0 / 10
Easy Check who you are logged in as
Why: Always confirm the account and identity before running changes.
What to do: Show the account ID and ARN of the identity your CLI is using.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Easy How many addresses in a /16?
Why: Picking a VPC size needs this count.
What to do: Latur Coaching Classes plans the VPC 10.56.0.0/16. How many IP addresses does it hold in total?
- Write down the numbers the task gives you.
- Work it out step by step on paper.
- Type only the final answer in the box.
- Click Check answer.
Medium Assume a role
Why: AssumeRole gives you short-lived keys for another role, often in another account.
What to do: Assume role arn:aws:iam::123666135775:role/Auditor with session name pooja-audit.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Medium Decode an "access denied" message
Why: Some errors come encoded; decoding shows exactly which policy blocked you.
What to do: Decode the authorization message stored in the shell variable $MSG.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Medium Trust policy for an EC2 role
Why: The trust policy says WHO may take the role.
What to do: Write a trust policy that lets ec2.amazonaws.com assume the role.
- Start with { "Version": "2012-10-17", "Statement": [ ... ] }.
- In each statement write Effect, Action and Resource.
- Give only what the task needs (least privilege).
- Use double quotes and commas correctly. Click Check answer.
Medium Trust policy for an ECS task role
Why: The trust policy says WHO may take the role.
What to do: Write a trust policy that lets ecs-tasks.amazonaws.com assume the role.
- Start with { "Version": "2012-10-17", "Statement": [ ... ] }.
- In each statement write Effect, Action and Resource.
- Give only what the task needs (least privilege).
- Use double quotes and commas correctly. Click Check answer.
Medium Trust policy for a Lambda role
Why: The trust policy says WHO may take the role.
What to do: Write a trust policy that lets lambda.amazonaws.com assume the role.
- Start with { "Version": "2012-10-17", "Statement": [ ... ] }.
- In each statement write Effect, Action and Resource.
- Give only what the task needs (least privilege).
- Use double quotes and commas correctly. Click Check answer.
Hard Let another account assume a role
Why: Cross-account roles are safer than sharing access keys.
What to do: Write a trust policy that lets account 111122223333 assume this role.
- Start with { "Version": "2012-10-17", "Statement": [ ... ] }.
- In each statement write Effect, Action and Resource.
- Give only what the task needs (least privilege).
- Use double quotes and commas correctly. Click Check answer.
Hard Assume a role for 15 minutes
Why: Shorter sessions lower the risk if keys leak.
What to do: Assume arn:aws:iam::123666135775:role/Deployer with session name deploy-job for 900 seconds.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Hard Get a session token with MFA
Why: Some actions need MFA. get-session-token returns keys that carry MFA proof.
What to do: Get a session token using MFA device arn:aws:iam::123666135775:mfa/pooja and the code 123456.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Revision, comparison and interview cards
Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.
More cards: Ravi Sir's Cards.