logo
Expand description

AWS Security Token Service

AWS Security Token Service (STS) enables you to request temporary, limited-privilege credentials for AWS Identity and Access Management (IAM) users or for users that you authenticate (federated users). This guide provides descriptions of the STS API. For more information about using this service, see Temporary Security Credentials.

If you’re using the service, you’re probably looking for StsClient and Sts.

Structs

Contains the response to a successful AssumeRole request, including temporary AWS credentials that can be used to make AWS requests.

Contains the response to a successful AssumeRoleWithSAML request, including temporary AWS credentials that can be used to make AWS requests.

Contains the response to a successful AssumeRoleWithWebIdentity request, including temporary AWS credentials that can be used to make AWS requests.

The identifiers for the temporary security credentials that the operation returns.

AWS credentials for API authentication.

A document that contains additional information about the authorization status of a request from an encoded message that is returned in response to an AWS request.

Identifiers for the federated user that is associated with the credentials.

Contains the response to a successful GetCallerIdentity request, including information about the entity making the request.

Contains the response to a successful GetFederationToken request, including temporary AWS credentials that can be used to make AWS requests.

Contains the response to a successful GetSessionToken request, including temporary AWS credentials that can be used to make AWS requests.

A reference to the IAM managed policy that is passed as a session policy for a role session or a federated user session.

AwsCredentials provider that calls AssumeRole using the provided StsClient. To use with MFA, pass in the MFA serial number then set the MFA code. You will need to ensure the provider has a valid code each time you acquire a new STS token.

A client for the AWS STS API.

AwsCredentials provider that calls GetSessionToken using the provided StsClient. To use with MFA, pass in the MFA serial number then set the MFA code. You will need to ensure the provider has a valid code each time you acquire a new STS token.

AwsCredentials provider that calls AssumeRoleWithWebIdentity using the provided StsClient.

You can pass custom key-value pair attributes when you assume a role or federate a user. These are called session tags. You can then use the session tags to control access to resources. For more information, see Tagging AWS STS Sessions in the IAM User Guide.

WebIdentityProvider using OpenID Connect bearer token to retrieve AWS IAM credentials.

Enums

Errors returned by AssumeRole

Errors returned by AssumeRoleWithSAML

Errors returned by AssumeRoleWithWebIdentity

Errors returned by DecodeAuthorizationMessage

Errors returned by GetAccessKeyInfo

Errors returned by GetCallerIdentity

Errors returned by GetFederationToken

Errors returned by GetSessionToken

Traits

Trait for conversions from STS Credentials to AWS Credentials.

Trait representing the capabilities of the AWS STS API. AWS STS clients implement this trait.