# AWS STS (/integrations/sts)





{/* MANUAL-CONTENT-START:intro */}

Use [AWS STS](https://docs.aws.amazon.com/STS/latest/APIReference/welcome.html) to request temporary credentials, assume roles, verify the calling identity, and identify the AWS account associated with an access key.

{/* MANUAL-CONTENT-END */}

## Use the block [#usage-instructions]

Assume roles, get temporary credentials, verify caller identity, and look up access key information.

## Actions [#actions]

### STS Assume Role [#sts-assume-role]

Assume an IAM role and receive temporary security credentials

<ReferenceDetails>
  #### Input [#input]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `region` | string | Yes | AWS region (e.g., us-east-1) |
  | `accessKeyId` | string | Yes | AWS access key ID |
  | `secretAccessKey` | string | Yes | AWS secret access key |
  | `roleArn` | string | Yes | ARN of the IAM role to assume |
  | `roleSessionName` | string | Yes | Identifier for the assumed role session |
  | `durationSeconds` | number | No | Duration of the session in seconds (900-43200, default 3600) |
  | `policy` | string | No | JSON IAM policy to further restrict session permissions (max 2048 chars) |
  | `externalId` | string | No | External ID for cross-account access |
  | `serialNumber` | string | No | MFA device serial number or ARN |
  | `tokenCode` | string | No | MFA token code (6 digits) |
  | `policyArns` | string | No | Comma-separated ARNs of up to 10 IAM managed policies to use as session policies |
  | `tags` | string | No | JSON object of up to 50 session tag key/value pairs for attribute-based access control |
  | `transitiveTagKeys` | string | No | Comma-separated tag keys that propagate through role chaining |

  #### Output [#output]

  | Parameter | Type | Description |
  | - | - | - |
  | `accessKeyId` | string | Temporary access key ID |
  | `secretAccessKey` | string | Temporary secret access key |
  | `sessionToken` | string | Temporary session token |
  | `expiration` | string | Credential expiration timestamp |
  | `assumedRoleArn` | string | ARN of the assumed role |
  | `assumedRoleId` | string | Assumed role ID with session name |
  | `packedPolicySize` | number | Percentage of allowed policy size used |
  | `sourceIdentity` | string | Source identity set on the role session, if any |
</ReferenceDetails>

### STS Assume Role With Web Identity [#sts-assume-role-with-web-identity]

Assume an IAM role using an OIDC/OAuth 2.0 web identity token (e.g. GitHub Actions OIDC, EKS IRSA, Google/Facebook federation) and receive temporary security credentials

#### Input [#input-1]

| Parameter | Type | Required | Description |
| - | - | - | - |
| `region` | string | Yes | AWS region (e.g., us-east-1) |
| `roleArn` | string | Yes | ARN of the IAM role to assume |
| `roleSessionName` | string | Yes | Identifier for the assumed role session |
| `webIdentityToken` | string | Yes | OAuth 2.0 access token or OpenID Connect ID token from the identity provider (up to 20000 chars) |
| `providerId` | string | No | Fully qualified host of a legacy OAuth 2.0 provider (e.g. [www.amazon.com](http://www.amazon.com)); omit for OpenID Connect providers |
| `policyArns` | string | No | Comma-separated ARNs of up to 10 IAM managed policies to use as session policies |
| `policy` | string | No | JSON IAM policy to further restrict session permissions (max 2048 chars) |
| `durationSeconds` | number | No | Duration of the session in seconds (900-43200, default 3600) |

#### Output [#output-1]

| Parameter | Type | Description |
| - | - | - |
| `accessKeyId` | string | Temporary access key ID |
| `secretAccessKey` | string | Temporary secret access key |
| `sessionToken` | string | Temporary session token |
| `expiration` | string | Credential expiration timestamp |
| `assumedRoleArn` | string | ARN of the assumed role |
| `assumedRoleId` | string | Assumed role ID with session name |
| `subjectFromWebIdentityToken` | string | Unique user identifier from the identity provider's token subject claim |
| `audience` | string | Intended audience (client ID) of the web identity token |
| `provider` | string | Issuing authority of the presented web identity token |
| `packedPolicySize` | number | Percentage of allowed policy size used |
| `sourceIdentity` | string | Source identity set on the role session, if any |

### STS Assume Role With SAML [#sts-assume-role-with-saml]

Assume an IAM role using a SAML 2.0 authentication response from an enterprise identity provider and receive temporary security credentials

#### Input [#input-2]

| Parameter | Type | Required | Description |
| - | - | - | - |
| `region` | string | Yes | AWS region (e.g., us-east-1) |
| `roleArn` | string | Yes | ARN of the IAM role to assume |
| `principalArn` | string | Yes | ARN of the SAML provider in IAM that describes the identity provider |
| `samlAssertion` | string | Yes | Base64-encoded SAML authentication response from the identity provider |
| `policyArns` | string | No | Comma-separated ARNs of up to 10 IAM managed policies to use as session policies |
| `policy` | string | No | JSON IAM policy to further restrict session permissions (max 2048 chars) |
| `durationSeconds` | number | No | Duration of the session in seconds (900-43200, default 3600) |

#### Output [#output-2]

| Parameter | Type | Description |
| - | - | - |
| `accessKeyId` | string | Temporary access key ID |
| `secretAccessKey` | string | Temporary secret access key |
| `sessionToken` | string | Temporary session token |
| `expiration` | string | Credential expiration timestamp |
| `assumedRoleArn` | string | ARN of the assumed role |
| `assumedRoleId` | string | Assumed role ID with session name |
| `subject` | string | Value of the NameID element in the Subject of the SAML assertion |
| `subjectType` | string | Format of the name ID (e.g. transient, persistent) |
| `issuer` | string | Value of the Issuer element of the SAML assertion |
| `audience` | string | Value of the SAML assertion's SubjectConfirmationData Recipient attribute |
| `nameQualifier` | string | Hash uniquely identifying the issuer, account, and SAML provider |
| `packedPolicySize` | number | Percentage of allowed policy size used |
| `sourceIdentity` | string | Source identity set on the role session, if any |

### STS Get Caller Identity [#sts-get-caller-identity]

Get details about the IAM user or role whose credentials are used to call the API

#### Input [#input-3]

| Parameter | Type | Required | Description |
| - | - | - | - |
| `region` | string | Yes | AWS region (e.g., us-east-1) |
| `accessKeyId` | string | Yes | AWS access key ID |
| `secretAccessKey` | string | Yes | AWS secret access key |

#### Output [#output-3]

| Parameter | Type | Description |
| - | - | - |
| `account` | string | AWS account ID |
| `arn` | string | ARN of the calling entity |
| `userId` | string | Unique identifier of the calling entity |

### STS Get Session Token [#sts-get-session-token]

Get temporary security credentials for an IAM user, optionally with MFA

#### Input [#input-4]

| Parameter | Type | Required | Description |
| - | - | - | - |
| `region` | string | Yes | AWS region (e.g., us-east-1) |
| `accessKeyId` | string | Yes | AWS access key ID |
| `secretAccessKey` | string | Yes | AWS secret access key |
| `durationSeconds` | number | No | Duration of the session in seconds (900-129600, default 43200) |
| `serialNumber` | string | No | MFA device serial number or ARN |
| `tokenCode` | string | No | MFA token code (6 digits) |

#### Output [#output-4]

| Parameter | Type | Description |
| - | - | - |
| `accessKeyId` | string | Temporary access key ID |
| `secretAccessKey` | string | Temporary secret access key |
| `sessionToken` | string | Temporary session token |
| `expiration` | string | Credential expiration timestamp |

### STS Get Access Key Info [#sts-get-access-key-info]

Get the AWS account ID associated with an access key

#### Input [#input-5]

| Parameter | Type | Required | Description |
| - | - | - | - |
| `region` | string | Yes | AWS region (e.g., us-east-1) |
| `accessKeyId` | string | Yes | AWS access key ID |
| `secretAccessKey` | string | Yes | AWS secret access key |
| `targetAccessKeyId` | string | Yes | The access key ID to look up |

#### Output [#output-5]

| Parameter | Type | Description |
| - | - | - |
| `account` | string | AWS account ID that owns the access key |