The document discusses AWS Security Token Service (STS), which enables users to request temporary security credentials. STS works with AWS Identity and Access Management (IAM) to provide credentials for IAM users or federated users authenticated outside of AWS. STS allows generating limited-privilege credentials for IAM users, federated users authenticated by an identity provider, and for delegating access to services that need to access AWS resources. The temporary credentials provided by STS can be used to make AWS API calls for the duration specified, providing a secure way to access AWS resources without long-term credentials.

1. Security Token Service (AWS STS)
1
~ Kaushik Mohanraj

2. Blazeclan
Agenda
Cloud IT Better2
• What is STS and what it has to offer…
• Recap on AWS IAM as prerequisite
• Why STS ????
• Brief information on its Details
• Use cases

3. Blazeclan
What is STS ??
Cloud IT Better3
• AWS STS : Security Token Service
• The AWS Security Token Service is a web service that enables you to request
temporary, limited-privilege credentials for AWS Identity and Access Management
(IAM) users or for users that you authenticate (federated users).

4. Blazeclan
And what was IAM …???
Cloud IT Better4
• AWS Identity and Access Management (IAM) enables you to securely control
access to AWS services and resources for your users.
• IAM enables you to create and manage users in AWS and access AWS
resources.
• IAM offers greater security, flexibility, and control when using AWS.
• IAM enables you to:
 Manage IAM users and their access
 Manage access for federated users

5. Blazeclan
A brush up on IAM Role, IAM User and IAM Group is…
Cloud IT Better5
• IAM User:
 A user is an individual, system, or application that interacts with AWS
programmatically
• IAM Group:
 A group is a collection of users. Groups don't directly interact with AWS; only
users do
• IAM Role:
 A role is an entity that has a set of permissions, and that another entity assumes
to make calls to access your AWS resources.
 GET http://169.254.169.254/latest/meta-data/iam/security-credentials/[role]

6. Blazeclan
Why STS…
When requested for Access through an STS API call it would typically return
Temporary Security credentials consisting of :
• Security Token
• An Access Key ID
• A Secret Access Key
Cloud IT Better6
• The access Key ID & Secret Access Key generated with the token cannot be used
without the token.
• There are No limits on the number of “Sets” that we can create.
• STS service is designed to have limited access on a couple of Services.(Link)

7. Blazeclan
Ways to Access STS
• API Calls
• AWS offers SDK’s for selected languages, namely
• Java
• PHP
• .Net
• Ruby
Cloud IT Better7
Link for any further
reference

8. Blazeclan
Types of User for whom you would Enable Access..
• Enable Access for IAM Users
• Enable Access for Federated Users
• Delegating API Access to Services
Cloud IT Better8

9. Blazeclan
Creating Temporary Security Credentials to Enable Access for
IAM Users
• IAM users can use the AWS Security Token Service
GetSessionToken API action to create temporary security
credentials for themselves
Cloud IT Better9
Example Request:
https://sts.amazonaws.com/
?Version=2011-06-15
&Action=GetSessionToken
&DurationSeconds=3600
&AUTHPARAMS
Action
Validity

10. Blazeclan
GetSessionToken Request Description
•Request Parameters
• DurationSeconds
• SerialNumber
• The identification number of the MFA device for
the user.
• TokenCode
• The value provided by the MFA device.
(Non of them are mandatory)
Cloud IT Better10
Note: You can specify the duration of the temporary security credentials to be from 15
minutes to 36 hours. By default, the credentials are valid for 12 hours.
Link for further Details

11. Blazeclan
Continued….
Cloud IT Better11
Expiration Time
Secret Access Key
Access Key ID

12. Blazeclan
You Still think you account would be compromised ??
Temporary Security Credentials for IAM Users with Multi-Factor
Authentication (MFA)
• The following is an example of a GetSessionToken request with an MFA verification
code and device serial number using the STS Query API.
Cloud IT Better12

13. Blazeclan
Creating Temporary Security Credentials to Enable Access for
Federated Users
So who is a Federated User ?
A Non-AWS user whose identity can be authenticated.
Cloud IT Better13

14. Blazeclan Cloud IT Better14
Creating Temporary Security Credentials to Enable Access for
Federated Users
Grant temporary access to a non-AWS user whose identity you
can authenticate (a federated user) use the AWS
STS GetFederationToken action
Action
Validity
Authentication From the Identity Broker

15. Blazeclan
GetFederationToken Request Description
•Request Parameters
• DurationSeconds –
(Optional)
• Name – (Mandatory)
• Policy – (Optional)
Cloud IT Better15
Note: You can specify the duration of the temporary security credentials to be from 15 minutes to 36
hours. By default, the credentials are valid for 12 hours only if created by IAM USERs; credentials
created using account credentials have a maximum duration of one hour.
Link for further Details

16. Blazeclan
Continued…..
Cloud IT Better16
Expiration Time
Secret Access Key
Access Key ID
Federated User ID

17. Blazeclan
GetFederationToken Response Description
•Response Parameters
• Credentials
• FederatedUser
• Identifiers for the federated user associated with the
credentials. You can use the federated user's ARN in your
resource policies.
• PackedPolicySize
• A percentage value indicating the size of the policy in packed
form. Policies for which the packed size is greater than 100%
of the allowed value are rejected by the service.
Cloud IT Better17

18. Blazeclan
Creating Temporary Security Credentials for Delegating API
Access
• We Know that we can delegate access to our AWS resources by
using IAM roles.
• IAM roles allow you to establish trusted relationships with other
AWS accounts (trusted entities)
• IAM users from trusted entities can use the AWS Security Token
Service AssumeRole action to obtain temporary security
credentials
• With the temporary security credentials, callers are granted the
permissions that are defined in the role.(only)
Note: You can specify the duration of the temporary security credentials to be from 15
minutes to one hour. By default, the credentials are valid for one hour.
Link for further Details
Cloud IT Better18

19. Blazeclan
Continued…
Cloud IT Better19
Requirements for assuming a role
To assume a role, the caller must meet the following
requirements:
•The caller must have permission to call AssumeRole for the
specific role.
•The role defines the caller's AWS account ID as a trusted entity.
•The caller must use IAM user credentials to assume a role.
•If the role has an external ID defined, the caller must pass that
external ID when calling AssumeRole

20. Blazeclan
External ID (Use-case Specific)
Cloud IT Better20
• An external ID is an additional piece of information that you can
specify when assuming an IAM role.
• As a third party, you might have multiple customers who use your
service to access or manage their AWS resources. You assign an
external ID that is associated with each customer. Customers
include this ID when they create a role that you can assume.
• Then each time you assume a role, you include the external ID as
part of the request.
• The external ID can be any identifier that is used to identify each
customer (it doesn't have to be a secret value). The only
requirement is that the external ID must be unique for each
customer.

21. Blazeclan
AssumeRole Request Description
Cloud IT Better21
Action
Validity
External ID

22. Blazeclan
AssumeRole Request Description
Request Parameters
• DurationSeconds – (Optional)
• ExternalId – (Optional)
• Policy – (Optional)
• RoleArn – (Mandatory)
• The ARN of the role that the caller is assuming.
• RoleSessionName – (Mandatory)
• An identifier for the assumed role session. The session name is
included as part of the AssumedRoleUser
Cloud IT Better22

23. Blazeclan
AssumeRole Response Description
Cloud IT Better23
Expiration Time
Packed Policy Size
Assumed Role
ARN

24. Blazeclan
AssumeRole Response Description
•Response Parameters
• AssumedRoleUser
• Credentials
• PackedPolicySize
• A percentage value indicating the size of the policy in packed
form. Policies for which the packed size is greater than 100%
of the allowed value are rejected by the service.
Cloud IT Better24

25. Blazeclan
How Permissions Work ?
Cloud IT Better25
Source : http://docs.aws.amazon.com/STS/latest/UsingSTS/FederationPermissions.html

26. Blazeclan
Use Cases
Cloud IT Better26
Source: http://docs.aws.amazon.com/STS/latest/UsingSTS/STSUseCases.html

27. Blazeclan
Use Cases
Cloud IT Better27
Source: http://docs.aws.amazon.com/STS/latest/UsingSTS/STSUseCases.html

28. Blazeclan
Cross Account Delegation(Clouldlytics Scenario)
Cloud IT Better28
Source : http://docs.aws.amazon.com/IAM/latest/UserGuide/Delegation.html

29. Blazeclan
Content References and Suggested Pages:
 AWS Documentation - Using Temporary Security Credentials
 AWS Documentation - AWS Security Token Service
 AWS Documentation - Using Temporary Security Credentials
 AWS Documentation - AWS Identity and Access Management
 AWS Documentation - Using Temporary Security Credentials
 AWS Documentation - AWS Identity and Access Management
Cloud IT Better29

30. Thank you
Thank You