Use AWS STS to request temporary credentials, assume roles, verify the calling identity, and identify the AWS account associated with an access key.
Assume roles, get temporary credentials, verify caller identity, and look up access key information.
Assume an IAM role and receive temporary security credentials
Parameter Type Required Description regionstring Yes AWS region (e.g., us-east-1) accessKeyIdstring Yes AWS access key ID secretAccessKeystring Yes AWS secret access key roleArnstring Yes ARN of the IAM role to assume roleSessionNamestring Yes Identifier for the assumed role session durationSecondsnumber No Duration of the session in seconds (900-43200, default 3600) policystring No JSON IAM policy to further restrict session permissions (max 2048 chars) externalIdstring No External ID for cross-account access serialNumberstring No MFA device serial number or ARN tokenCodestring No MFA token code (6 digits) policyArnsstring No Comma-separated ARNs of up to 10 IAM managed policies to use as session policies tagsstring No JSON object of up to 50 session tag key/value pairs for attribute-based access control transitiveTagKeysstring No Comma-separated tag keys that propagate through role chaining
Parameter Type Description accessKeyIdstring Temporary access key ID secretAccessKeystring Temporary secret access key sessionTokenstring Temporary session token expirationstring Credential expiration timestamp assumedRoleArnstring ARN of the assumed role assumedRoleIdstring Assumed role ID with session name packedPolicySizenumber Percentage of allowed policy size used sourceIdentitystring Source identity set on the role session, if any
Assume an IAM role using an OIDC/OAuth 2.0 web identity token (e.g. GitHub Actions OIDC, EKS IRSA, Google/Facebook federation) and receive temporary security credentials
Parameter Type Required Description regionstring Yes AWS region (e.g., us-east-1) roleArnstring Yes ARN of the IAM role to assume roleSessionNamestring Yes Identifier for the assumed role session webIdentityTokenstring Yes OAuth 2.0 access token or OpenID Connect ID token from the identity provider (up to 20000 chars) providerIdstring No Fully qualified host of a legacy OAuth 2.0 provider (e.g. www.amazon.com ); omit for OpenID Connect providers policyArnsstring No Comma-separated ARNs of up to 10 IAM managed policies to use as session policies policystring No JSON IAM policy to further restrict session permissions (max 2048 chars) durationSecondsnumber No Duration of the session in seconds (900-43200, default 3600)
Parameter Type Description accessKeyIdstring Temporary access key ID secretAccessKeystring Temporary secret access key sessionTokenstring Temporary session token expirationstring Credential expiration timestamp assumedRoleArnstring ARN of the assumed role assumedRoleIdstring Assumed role ID with session name subjectFromWebIdentityTokenstring Unique user identifier from the identity provider's token subject claim audiencestring Intended audience (client ID) of the web identity token providerstring Issuing authority of the presented web identity token packedPolicySizenumber Percentage of allowed policy size used sourceIdentitystring Source identity set on the role session, if any
Assume an IAM role using a SAML 2.0 authentication response from an enterprise identity provider and receive temporary security credentials
Parameter Type Required Description regionstring Yes AWS region (e.g., us-east-1) roleArnstring Yes ARN of the IAM role to assume principalArnstring Yes ARN of the SAML provider in IAM that describes the identity provider samlAssertionstring Yes Base64-encoded SAML authentication response from the identity provider policyArnsstring No Comma-separated ARNs of up to 10 IAM managed policies to use as session policies policystring No JSON IAM policy to further restrict session permissions (max 2048 chars) durationSecondsnumber No Duration of the session in seconds (900-43200, default 3600)
Parameter Type Description accessKeyIdstring Temporary access key ID secretAccessKeystring Temporary secret access key sessionTokenstring Temporary session token expirationstring Credential expiration timestamp assumedRoleArnstring ARN of the assumed role assumedRoleIdstring Assumed role ID with session name subjectstring Value of the NameID element in the Subject of the SAML assertion subjectTypestring Format of the name ID (e.g. transient, persistent) issuerstring Value of the Issuer element of the SAML assertion audiencestring Value of the SAML assertion's SubjectConfirmationData Recipient attribute nameQualifierstring Hash uniquely identifying the issuer, account, and SAML provider packedPolicySizenumber Percentage of allowed policy size used sourceIdentitystring Source identity set on the role session, if any
Get details about the IAM user or role whose credentials are used to call the API
Parameter Type Required Description regionstring Yes AWS region (e.g., us-east-1) accessKeyIdstring Yes AWS access key ID secretAccessKeystring Yes AWS secret access key
Parameter Type Description accountstring AWS account ID arnstring ARN of the calling entity userIdstring Unique identifier of the calling entity
Get temporary security credentials for an IAM user, optionally with MFA
Parameter Type Required Description regionstring Yes AWS region (e.g., us-east-1) accessKeyIdstring Yes AWS access key ID secretAccessKeystring Yes AWS secret access key durationSecondsnumber No Duration of the session in seconds (900-129600, default 43200) serialNumberstring No MFA device serial number or ARN tokenCodestring No MFA token code (6 digits)
Parameter Type Description accessKeyIdstring Temporary access key ID secretAccessKeystring Temporary secret access key sessionTokenstring Temporary session token expirationstring Credential expiration timestamp
Get the AWS account ID associated with an access key
Parameter Type Required Description regionstring Yes AWS region (e.g., us-east-1) accessKeyIdstring Yes AWS access key ID secretAccessKeystring Yes AWS secret access key targetAccessKeyIdstring Yes The access key ID to look up
Parameter Type Description accountstring AWS account ID that owns the access key