IAM / security / sts

AWS STS (IAM)

JSON →

AWSstssecurity

AWS Security Token Service (STS) grants temporary, limited-privilege credentials for IAM users or federated users.

iamaws

docs ↗

Permissions

Actions in this service

sts:GetCallerIdentity

sts:GetSessionToken

sts:GetFederationToken

sts:GetWebIdentityToken

sts:GetAccessKeyInfo

sts:GetServiceBearerToken

sts:TagSession

sts:GetDelegatedAccessToken

Policy

Minimal privilege example

Copy-paste least-privilege policy statement — not yet harness-verified.

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sts:GetCallerIdentity", "sts:GetSessionToken", "sts:GetFederationToken", "sts:GetWebIdentityToken", "sts:GetAccessKeyInfo", "sts:GetServiceBearerToken", "sts:TagSession", "sts:GetDelegatedAccessToken" ], "Resource": "*" } ] }

SDK mapping

Method → permission

SDK method mapping (e.g. boto3.get_object() → s3:GetObject) is not yet collected.

Footguns

Known gotchas

Avoid sts:* — grants full control including token generation that can bypass MFA.

Avoid sts:GetFederationToken without conditions — can create long-lived credentials.

Resources

docshttps://servicereference.us-east-1.amazonaws.com/v1/sts/sts.json ↗