‫So let's talk about STS,
‫which is a Security Token Service.
‫So STS allows you to get temporary
‫security credentials up to one hour to
‫access those resources directly.
‫And so there's a bunch of API you need
‫to know them at a high level going into the exam.
‫So the first one is AssumeRole,
‫to assume roles within your accounts
‫or cross accounts, which is fundamental.
‫AssumeRoleWithSAML in case your users are
‫logged in with SAML, this is allowing
‫us to get them allowing them to
‫get temporary credentials.
‫AssumeRoleWithWebIdentity to return roles
‫for users if they're logged with
‫an identity provider.
‫So Facebook Login, Google Login, or
‫OIDC compatible. But we don't use this
‫really anymore. Now we use
‫Cognito Identity Pools instead.
‫Instead of AssumeRoleWithWebIdentity.
‫Then we have GetSessionToken and we will
‫see this very in-depth so this is
‫when you have MFA for a user or AWS root account.
‫Then GetFederationToken to get
‫temporary credentials for a federated user.
‫GetCallerIdentity, which is return details
‫about the IAM user or role used into the API call.
‫So if you don't know who you are
‫while using AWS, just call the STS
‫GetCallerIdentity and you'll get information
‫about who you are and what's your account number.
‫And then we've seen that one as
‫well in the beginning.
‫DecodeAuthorizationMessage to decode an error
‫message when it AWS API is denied.
‫So the most important ones going
‫into the exam is going to be AssumeRole,
‫GetSessionToken, GetCallerIdentity and
‫DecodeAuthorizationMessage.
‫So STS can assume, can be used to assume a role,
‫so let's see how that works.
‫So first we define an IAM role in our accounts
‫if we want to AssumeRole within our accounts.
‫Or in another account if you want to do
‫cross-accounts.
‫Then you define which principles can access
‫this IAM role and we authorize everything
‫with IAM policies.
‫And then we would use the STS API to do
‫the AssumeRole API call to impersonate
‫the IAM role we have access to.
‫Then the credentials valid between 15 minutes
‫up to one hour.
‫So in the diagram, our users wants to access
‫a role within the same or another account.
‫And to do so, it's going to do the AssumeRole
‫API onto STS.
‫STS will check the permissions are correct or not.
‫And then will return to us the
‫temporary security credentials,
‫which would allow us to act as if we were the role.
‫Then for cross accounts access,
‫this is pretty similar,
‫we would create the role in another account.
‫Then we would write the correct permissions
‫in to our own account and the target account,
‫and finally run the AssumeRole API to access
‫the target accounts.
‫And for example, the role allowed us to access
‫an S3 bucket, then we can access that
‫S3 bucket in to our account, great.
‫Finally, for STS with MFA, so this is
‫very important to understand, going in to
‫certified developer exam.
‫So for this, you use the GetSessionToken API
‫from STS to get a session token.
‫Once you're logged in with an API with an
‫MFA device, and we've seen this in the CLS section.
‫Then we need the IAM policy with the
‫proper IAM conditions.
‫And then in the IAM policy, you need to
‫add this aws:MultiFactorAuthPresent:true,
‫which is very explicit and this looks like this.
‫For example, this role only allows us to
‫stop instances or terminate instances only if
‫we have MFA on, so MultiFactorAuthPresent:true.
‫And this is how we would use it.
‫So GetSessionToken is the API to use,
‫and why is it?
‫Well because it returns an Access ID,
‫a secret key but also a session token
‫that we have to include.
‫So three things to do our API call,
‫and the last one, GetSessionToken returns
‫the expiry date of our credentials,
‫so we know when to renew them.
‫Okay, so that's it for STS, I hope you liked it
‫and I will see you in the next lecture!