AWS Security Token Service (STS)
Status: Scaffold — content in progress
STS issues temporary security credentials (access key + secret + session token) for role assumption. It is the core of the AWS identity architecture.
Key STS Operations
| Operation | Use Case | Attack |
|---|---|---|
AssumeRole | Assume a role in same or different account | Role chaining privilege escalation |
AssumeRoleWithSAML | SAML federation | Golden SAML → forge SAML assertion |
AssumeRoleWithWebIdentity | OIDC federation (EKS, GitHub Actions) | OIDC token forgery |
GetSessionToken | MFA-protected sessions | |
GetFederationToken | Legacy federation |
IMDS v1 / v2 and Token Theft
Instance Metadata Service (IMDS) at 169.254.169.254 returns temporary credentials for the EC2 instance's IAM role.
- IMDSv1: No authentication — any HTTP request from instance gets credentials (SSRF risk)
- IMDSv2: Requires PUT request first (session token) — mitigates SSRF
SSRF → IMDS → http://169.254.169.254/latest/meta-data/iam/security-credentials/<role> → stolen credentials
Cross-Links
| Topic | Link |
|---|---|
| AWS IAM Overview | aws-iam-overview |