AWS Expands STS to Support Cross-Partition Temporary Credentials, Replacing Long-Term Keys
AWS updated its Security Token Service to allow workloads to use temporary credentials across different AWS partitions, reducing reliance on long-term IAM keys.
Amazon Web Services (AWS) has announced an expansion of its Security Token Service (STS), enabling workloads to use their existing identities to obtain temporary credentials across different AWS partitions, such as the Commercial partition and the GovCloud (US) partition. This update aims to address the need for enterprises to store long-term IAM access keys for cross-partition operations, thereby reducing the risk of key leakage and management overhead.
AWS partitions are independent environments composed of one or more cloud regions, each with its own Identity and Access Management (IAM) system. Previously, credentials issued in one partition could not be used directly in another. The new mechanism utilizes existing GetWebIdentityToken and AssumeRoleWithWebIdentity APIs: workloads first obtain a short-lived JSON Web Token (JWT) from the source partition's STS, then send it to the target partition's STS to exchange for temporary credentials for a specified IAM role. The target partition's STS validates the token and issues credentials based on the IAM role's trust policy, with access still restricted by IAM permission policies.
Cross-partition access is not enabled by default; administrators must enable external identity federation in the source account and establish trust relationships in the target account. Enterprises can set access conditions based on source accounts, IAM identities, and regions, with AWS CloudTrail logging token issuance and credential exchange activities in both partitions. The feature is currently available in all AWS Commercial Regions, GovCloud (US), China Regions, and the AWS European Sovereign Cloud region in Germany at no additional cost.