Skip to content
GoHackersCloud Academy

Lesson 11 — AWS Security Token Service (STS) & Temporary Credentials

Learning Path

☁️ Phase 2 – AWS Cloud Security

📘 Module 02 – Identity & Access Management (IAM)

🎯 Lesson Objective

Section titled “🎯 Lesson Objective”

By the end of this lesson, you will be able to:

  • Understand AWS Security Token Service (STS).
  • Explain temporary security credentials.
  • Learn how AssumeRole works.
  • Understand session tokens.
  • Access AWS resources securely using temporary credentials.
  • Understand enterprise use cases for STS.
  • Apply STS using the AWS CLI.

📚 Lesson Information

Estimated Time: 4 Hours

Difficulty: Intermediate

Prerequisites: Lesson 10 – AWS IAM Identity Center

Hands-on Lab: Yes

Assignment: Yes

💼 Business Value

Section titled “💼 Business Value”

Modern enterprises rarely use permanent AWS Access Keys.

Instead, they rely on temporary credentials that automatically expire after a limited period.

This approach significantly reduces the risk of:

  • Credential theft
  • Long-term credential exposure
  • Insider threats
  • Accidental credential leaks
  • Compliance violations

AWS Security Token Service (STS) is the service responsible for issuing these temporary credentials.

🏢 In the Company

Section titled “🏢 In the Company”

CloudNova Technologies has adopted a Zero Trust security model.

Developers, Security Engineers and automated workloads must access AWS resources without storing permanent credentials.

The CISO introduces the following policy:

“No long-term AWS Access Keys should be stored on laptops, servers or applications. All access must use temporary credentials issued by AWS STS.”

Your responsibility is to understand how AWS STS provides secure, temporary access.

🌍 What is AWS Security Token Service (STS)?

Section titled “🌍 What is AWS Security Token Service (STS)?”

AWS Security Token Service (STS) is a global AWS service that issues temporary security credentials.

These credentials allow users, applications and AWS services to securely access AWS resources for a limited period.

Temporary credentials automatically expire, reducing the risk of compromise.

🔑 What Are Temporary Credentials?

Section titled “🔑 What Are Temporary Credentials?”

Temporary credentials consist of three components:

  • Access Key ID
  • Secret Access Key
  • Session Token

Unlike permanent IAM User credentials, these credentials have an expiration time.

Once the session expires, the credentials can no longer be used.

🔄 How STS Works

Section titled “🔄 How STS Works”
User / Application


        │


Requests Temporary Access


        │


AWS STS


        │


Issues Temporary Credentials


        │


Access Key ID
Secret Access Key
Session Token


        │


Access AWS Resources


        │


Credentials Expire Automatically

🔐 Why Temporary Credentials?

Section titled “🔐 Why Temporary Credentials?”

Compared to permanent Access Keys, temporary credentials offer several advantages.

Permanent Credentials Temporary Credentials
Never expire Expire automatically
Manual rotation required Automatic expiration
Higher security risk Reduced attack surface
Difficult to manage Easier to manage
Common target for attackers Less valuable if stolen

🏗 Common STS Operations

Section titled “🏗 Common STS Operations”

AWS STS supports several operations.

Operation Purpose
AssumeRole Access resources using an IAM Role
GetSessionToken Temporary credentials for IAM Users
GetCallerIdentity Identify the current AWS identity
AssumeRoleWithSAML Federation using SAML
AssumeRoleWithWebIdentity Federation using external identity providers

🎭 What is AssumeRole?

Section titled “🎭 What is AssumeRole?”

AssumeRole allows a user or application to temporarily become another IAM Role.

Instead of assigning permanent permissions, AWS grants temporary credentials for the duration of the session.

This is the most common STS operation used in enterprise environments.

🏢 Enterprise Example

Section titled “🏢 Enterprise Example”

CloudNova employs a Security Engineer named Alice.

Alice normally has read-only permissions.

When an incident occurs, she temporarily assumes the following role:

IncidentResponseRole

AWS STS issues temporary credentials valid for one hour.

Once the investigation is complete, the credentials expire automatically.

Alice returns to her normal permissions without any manual changes.

⏱ Session Duration

Section titled “⏱ Session Duration”

Temporary credentials remain valid only for a limited period.

Common session durations include:

  • 15 minutes
  • 1 hour
  • 4 hours
  • 8 hours
  • 12 hours (depending on configuration)

After expiration, users must request new credentials.

🛡 Benefits of AWS STS

Section titled “🛡 Benefits of AWS STS”
  • No long-term credentials
  • Automatic expiration
  • Improved security
  • Better auditing
  • Supports cross-account access
  • Supports federation
  • Simplifies credential management
  • Reduces credential theft risks

🌐 Enterprise Use Cases

Section titled “🌐 Enterprise Use Cases”

CloudNova uses AWS STS for:

  • Cross-account administration
  • Incident response
  • CI/CD deployments
  • AWS Lambda execution
  • Amazon EC2 instance access
  • Kubernetes workloads
  • Temporary contractor access
  • Federated workforce authentication

🚫 Common Mistakes

Section titled “🚫 Common Mistakes”

Avoid the following:

❌ Hardcoding Access Keys in applications.

❌ Sharing IAM User credentials.

❌ Creating permanent administrator accounts.

❌ Ignoring credential expiration.

❌ Using the Root User for automation.

✅ Enterprise Best Practices

Section titled “✅ Enterprise Best Practices”
  • Prefer IAM Roles over IAM Users.
  • Use AssumeRole wherever possible.
  • Rotate temporary sessions frequently.
  • Enable CloudTrail logging.
  • Monitor STS API calls.
  • Follow Least Privilege.
  • Require MFA for privileged role assumptions.

🧪 Enterprise Mission 01 — Identify Your Current Identity

Section titled “🧪 Enterprise Mission 01 — Identify Your Current Identity”

Open PowerShell.

Run:

Terminal window
aws sts get-caller-identity

Review:

  • Account ID
  • User ARN
  • User ID

Document your findings.

🧪 Enterprise Mission 02 — Review IAM Role

Section titled “🧪 Enterprise Mission 02 — Review IAM Role”

Navigate to:

IAM


↓


Roles

Select:

CloudEngineerRole

Review:

  • Trust Policy
  • Attached Policies
  • Permissions

🧪 Enterprise Mission 03 — Assume an IAM Role

Section titled “🧪 Enterprise Mission 03 — Assume an IAM Role”

Run:

Terminal window
aws sts assume-role \
--role-arn arn:aws:iam::ACCOUNT_ID:role/CloudEngineerRole \
--role-session-name CloudNovaSession

Observe the response.

It includes:

  • AccessKeyId
  • SecretAccessKey
  • SessionToken
  • Expiration

🧪 Enterprise Mission 04 — Configure Temporary Credentials

Section titled “🧪 Enterprise Mission 04 — Configure Temporary Credentials”

Store the temporary credentials as environment variables.

PowerShell:

Terminal window
$Env:AWS_ACCESS_KEY_ID="TEMP_ACCESS_KEY"
$Env:AWS_SECRET_ACCESS_KEY="TEMP_SECRET_KEY"
$Env:AWS_SESSION_TOKEN="TEMP_SESSION_TOKEN"

Verify the active identity.

Terminal window
aws sts get-caller-identity

🧪 Enterprise Mission 05 — Review Session Expiration

Section titled “🧪 Enterprise Mission 05 — Review Session Expiration”

Observe the following field returned by STS.

Expiration

Answer:

  • When will the credentials expire?
  • What happens after expiration?
  • How should applications obtain new credentials?

🧪 Enterprise Mission 06 — Review CloudTrail Events

Section titled “🧪 Enterprise Mission 06 — Review CloudTrail Events”

Navigate to:

CloudTrail


↓


Event History

Filter for:

AssumeRole

Review:

  • User
  • Time
  • Source IP
  • Event Details

🧪 Enterprise Mission 07 — Security Investigation

Section titled “🧪 Enterprise Mission 07 — Security Investigation”

CloudNova detects unusual activity.

CloudTrail shows multiple AssumeRole API calls originating from an unexpected IP address.

Investigate:

  • Who assumed the role?
  • Which role was used?
  • When was it used?
  • Was MFA required?
  • What actions should be taken?

Document your findings.

🧪 Enterprise Mission 08 — Enterprise Design Exercise

Section titled “🧪 Enterprise Mission 08 — Enterprise Design Exercise”

CloudNova has:

  • Developers
  • Security Engineers
  • DevOps Engineers
  • Third-party Consultants

Design a temporary credential strategy.

Include:

  • Which users should use STS?
  • Which roles should be assumed?
  • Recommended session durations.
  • Logging and monitoring requirements.

🏢 Enterprise Scenario

Section titled “🏢 Enterprise Scenario”

CloudNova hires an external security consulting company for a two-week security assessment.

The consultants require temporary access to AWS resources.

Management does not want to:

  • Create permanent IAM Users.
  • Share administrator credentials.
  • Leave unused accounts after the engagement ends.

Design a secure solution using AWS STS and IAM Roles.

📊 Knowledge Check

Section titled “📊 Knowledge Check”

  1. What is AWS Security Token Service?

  2. What are temporary security credentials?

  3. Which three values make up temporary credentials?

  4. What does AssumeRole do?

  5. Why are temporary credentials more secure than permanent credentials?

  6. Which CLI command identifies your current AWS identity?

  7. What happens when temporary credentials expire?

  8. Why is CloudTrail important when using STS?

  9. Give three enterprise use cases for AWS STS.

  10. Why do modern organisations prefer IAM Roles with STS?

📝 Assignment

Section titled “📝 Assignment”

Prepare an AWS STS & Temporary Credentials Implementation Guide.

Include:

  • STS Overview
  • Temporary Credentials
  • AssumeRole
  • Session Tokens
  • Enterprise Use Cases
  • Security Benefits
  • AWS CLI Commands Used
  • CloudTrail Monitoring
  • Lessons Learned

Length: 5–6 Pages

📋 Lesson Completion Checklist

Section titled “📋 Lesson Completion Checklist”
Task Status
Reviewed Current Identity ☐
Reviewed IAM Role ☐
Assumed IAM Role ☐
Configured Temporary Credentials ☐
Verified Caller Identity ☐
Reviewed CloudTrail Events ☐
Completed Security Investigation ☐
Completed Enterprise Design ☐
Completed Assignment ☐

💡 Key Takeaways

Section titled “💡 Key Takeaways”

After completing this lesson, you should understand:

  • AWS Security Token Service (STS) provides temporary security credentials for secure access to AWS resources.
  • Temporary credentials include an Access Key ID, Secret Access Key and Session Token, and expire automatically.
  • The AssumeRole operation enables secure, temporary access without sharing long-term credentials.
  • AWS STS is widely used for cross-account access, federation, automation and enterprise security.
  • Using IAM Roles with AWS STS is a cloud security best practice that reduces the risk associated with permanent credentials.

📚 Further Reading

Section titled “📚 Further Reading”
  • AWS Security Token Service User Guide
  • AWS IAM Roles Documentation
  • AWS IAM Best Practices
  • AWS CloudTrail User Guide
  • AWS Well-Architected Framework – Security Pillar

🚀 Next Lesson

Section titled “🚀 Next Lesson”

➡️ Lesson 12 — Cross-Account Access