AWS Enables Cross-Partition Cloud Access Using Temporary Credentials
Cybersecurity and privacy
AWS has updated its Security Token Service (STS) to allow workloads to obtain temporary credentials across AWS Partitions, mitigating security risks associated with long-term IAM access keys. The feature uses existing APIs to exchange short-lived tokens, requires explicit trust configuration, and is now available across major commercial, government, and sovereign cloud partitions at no extra cost.
AWS has expanded AWS Security Token Service (STS) capabilities, allowing workloads to leverage their existing identities to acquire temporary credentials across different AWS Partitions. Historically, isolated partitions such as commercial AWS and AWS GovCloud operated with distinct IAM boundaries, often necessitating long-lived IAM keys for cross-partition management calls. Under the new workflow, workloads use GetWebIdentityToken to fetch a short-lived JWT from the source partition, which is then presented via AssumeRoleWithWebIdentity to the target partition STS to receive temporary credentials. This access pattern is not enabled by default, requiring administrators to configure identity federation and IAM trust policies, while all token and credential issuance can be audited using AWS CloudTrail. The capability is deployed across commercial, GovCloud (US), China, and European Sovereign Cloud regions without additional charges.
Key takeaways
- AWS STS now facilitates cross-partition credential issuance using short-lived JWTs to replace long-term IAM access keys.
- The feature requires manual configuration of identity federation and IAM trust relationships, with all actions trackable in AWS CloudTrail.
- The capability is available across AWS commercial regions, GovCloud (US), China, and the European Sovereign Cloud partition at no extra cost.
Source：iThome Read the original ↗
Prepared, checked and automatically published by AI; not individually reviewed by a human. Translation checked by AI.