STS
Prefix sts, 16 actions · Domain Security, Identity & Compliance
11 AWS managed policies. 1 have reviewed guidance; the rest have authoritative permission data pending editorial review. 3 are service-linked role policies, shown with permission data only.
User access (1)
Operator and limited (3)
Service roles (4)
Service-linked roles (3)
Also grants STS actions (56)
- AdministratorAccess
- AdministratorAccess-Amplify
- AIDevOpsAgentActionsPolicy
- AIOpsConsoleAdminPolicy
- AIOpsOperatorAccess
- AmazonEKSMCPReadOnlyAccess
- AmazonElasticContainerRegistryPublicFullAccess
- AmazonElasticContainerRegistryPublicPowerUser
- AmazonInspector2ThirdPartyServiceRolePolicy
- AmazonLaunchWizard_Fullaccess
- AmazonLaunchWizardFullAccessV2
- AmazonQDeveloperAccess
- AmazonQFullAccess
- AmazonQuickSuiteAccessPolicy
- AmazonRedshiftFederatedAuthorization
- AmplifyBackendDeployFullAccess
- AnthropicFullAccess
- AnthropicLimitedAccess
- AnthropicReadOnlyAccess
- AWS_ConfigRole
- AWS-SSM-DiagnosisAutomation-AdministrationRolePolicy
- AWS-SSM-RemediationAutomation-AdministrationRolePolicy
- AWSCODAPermissionsBoundary
- AWSCodeArtifactAdminAccess
- AWSCodeArtifactReadOnlyAccess
- AWSConfigServiceRolePolicy
- AWSControlTowerServiceRolePolicy
- AWSElasticBeanstalkEKSImageBuild
- AwsGlueDataBrewFullAccessPolicy
- AWSManagedAccountManagementAccess
- AWSManagedSettingsAdminAccess
- AWSMcpServiceActionsFullAccess
- AWSPartnerCentralChannelManagement
- AWSPartnerCentralFullAccess
- AWSResourceExplorerServiceRolePolicy
- AWSSecurityHubV2ServiceRolePolicy
- AWSServiceRoleForImageBuilder
- AWSSupportServiceRolePolicy
- AWSTransformNetworkMigrationAgentPolicy
- AWSTransformServerMigrationAgentPolicy
- AWSWellArchitectedAgentResourceScanningServiceRolePolicy
- CloudFormationStackSetsOrgAdminServiceRolePolicy
- EC2ImageBuilderExecutionPolicy
- PowerUserAccess
- ReadOnlyAccess
- ROSASRESupportPolicy
- SageMakerStudioAdminIAMDefaultExecutionPolicy
- SageMakerStudioAdminIAMPermissiveExecutionPolicy
- SageMakerStudioDomainExecutionRolePolicy
- SageMakerStudioProjectRoleMachineLearningPolicy
- SageMakerStudioProjectUserRolePermissionsBoundary
- SageMakerStudioProjectUserRolePolicy
- SageMakerStudioUserIAMDefaultExecutionPolicy
- SageMakerStudioUserIAMPermissiveExecutionPolicy
- SecurityAudit
- WellArchitectedAgentResourceScanning
assumerole assumerolewithsaml assumerolewithwebidentity assumeroot decodeauthorizationmessage getaccesskeyinfo getcalleridentity getdelegatedaccesstoken getfederationtoken getservicebearertoken getsessiontoken getwebidentitytoken setcontext setsourceidentity taggetwebidentitytoken tagsession
Actions (16)
| Action | Access level | Policies granting without limits | Policies granting with resource or condition limits |
|---|---|---|---|
| sts:AssumeRole | Write | 8 | 24 |
| sts:AssumeRoleWithSAML | Write | 3 | 1 |
| sts:AssumeRoleWithWebIdentity | Write | 3 | 1 |
| sts:AssumeRoot | Write | 2 | 1 |
| sts:DecodeAuthorizationMessage | Write | 5 | 1 |
| sts:GetAccessKeyInfo | Read | 5 | 1 |
| sts:GetCallerIdentity | Read | 13 | 4 |
| sts:GetDelegatedAccessToken | Write | 3 | 1 |
| sts:GetFederationToken | Write | 3 | 1 |
| sts:GetServiceBearerToken | Read | 12 | 4 |
| sts:GetSessionToken | Read | 4 | 1 |
| sts:GetWebIdentityToken | Write | 3 | 8 |
| sts:SetContext | Write | 3 | 10 |
| sts:SetSourceIdentity | Write | 3 | 7 |
| sts:TagGetWebIdentityToken | Tagging | 6 | 1 |
| sts:TagSession | Tagging | 4 | 11 |