Sts

Basics

• STS generates temporary security credentials or tokens
• They are similar to access keys access Key ID & secret Access Key
• These credenitals expire after specified duration
• The permissions to temporary credenitals can be restricted to a subset of permissions specified in a Role's permission policy
• Temporary credentials are always requested by another identity
• Temporary Credentials consist of
• Access Key Id
• Expiration Time
• Secret Access Key
• Session Token
• Once given the temporary security credentials can not be invalidated till the expiration time
• If a temporary credential is leaked best way to handle is DENY access to any sessions older than NOW. This is acheived by adding inline permissions policy with AWSRevokeOlderSessions for sessions older than now