Security Token Service
A Security Token Service (STS) is a web service that issues, validates, and exchanges security tokens — such as temporary credentials or identity assertions — allowing systems to authenticate and authorize access without repeatedly sharing…
Definition
A Security Token Service (STS) is a web service that issues, validates, and exchanges security tokens — such as temporary credentials or identity assertions — allowing systems to authenticate and authorize access without repeatedly sharing long-lived secrets.
Overview
An STS acts as a trusted intermediary in federated identity and token-based authentication flows: a client authenticates to the STS (often via a separate identity provider), and in return receives a short-lived security token that downstream services can accept as proof of identity or authorization, rather than requiring each service to independently verify the original credentials. This pattern reduces how widely long-lived secrets like passwords or root API keys need to be shared, since temporary tokens can be scoped to specific permissions and expire automatically. A well-known implementation is AWS Security Token Service, which issues temporary, limited-privilege credentials for accessing AWS resources — commonly used for cross-account access, federated login (e.g., via Identity and Access Management (IAM) roles), and workloads running on EC2 or Lambda that need temporary credentials rather than permanent access keys. Similar concepts appear in broader identity standards like OAuth 2.0 token exchange and SAML assertions issued by an identity provider, and the resulting tokens are frequently handled alongside broader Secrets Management practice. Because implementations and exact mechanics vary significantly across vendors and standards, teams should consult vendor-specific documentation (such as AWS's own STS reference) when implementing token exchange flows; broader identity and access patterns are covered in Cloud Security Fundamentals.
Key Features
- Issues short-lived, scoped security tokens instead of long-lived secrets
- Acts as a trusted intermediary in federated authentication flows
- Reduces exposure of permanent credentials across systems
- AWS STS is a widely used implementation for temporary AWS credentials
- Supports cross-account access and federated identity scenarios
- Related to broader standards like OAuth 2.0 token exchange and SAML
Use Cases
Frequently Asked Questions
From the Blog
JWT Explained: How Token Authentication Works
Learn how JSON Web Tokens work: their three-part structure, signatures, stateless authentication, and the security pitfalls every developer should avoid.
Read More Cloud & CybersecurityZero Trust Security Explained
Zero Trust means never trust, always verify. Learn how this model replaces the old network perimeter and secures modern cloud and remote work setups.
Read More Cloud & CybersecurityDevSecOps: Building Security Into Your Pipeline
DevSecOps builds security into every stage of software delivery instead of bolting it on at the end. Learn the practices, tools, and culture that make it work.
Read More Cloud & CybersecurityCommon Web Security Vulnerabilities (OWASP Top 10)
The OWASP Top 10 ranks the most critical web application security risks. Learn what each one is, how attackers exploit it, and how to defend against it.
Read More