From e2f40435c6e75193cbd01d5548fe6371e38bbf92 Mon Sep 17 00:00:00 2001 From: kanywst <45947799+kanywst@users.noreply.github.com> Date: Wed, 11 Nov 2026 00:49:45 +0900 Subject: [PATCH 1/3] fix(content): cover STS cross-partition federation (2026-11) Credentials still do not cross partitions directly, but since 2026-11-09 a GetWebIdentityToken JWT can be exchanged with AssumeRoleWithWebIdentity in another partition. Replace the "credentials never cross partitions" claim, add the timeline entry and the aws:CrossPartitionSourceRegion key, and bump the as-of date after re-checking the monthly freshness list. --- README.ja.md | 2 +- README.md | 2 +- docs/02-endpoints.md | 4 ++-- docs/05-credential-paths.md | 4 +++- docs/07-timeline.md | 9 ++++++--- src/data/asOf.ts | 2 +- src/features/api/ops.ts | 4 ++-- src/features/endpoints/decide.ts | 4 ++-- src/features/glossary/terms.ts | 4 ++-- src/features/timeline/events.ts | 13 +++++++++++++ src/features/trust/catalog.ts | 13 +++++++++++++ 11 files changed, 46 insertions(+), 15 deletions(-) diff --git a/README.ja.md b/README.ja.md index 53255f2..0dd1b26 100644 --- a/README.ja.md +++ b/README.ja.md @@ -27,7 +27,7 @@ AWS の認証情報を図解するサイトです。英語と日本語に対応 | 9 | エラー | エラーメッセージを貼ると原因と対処を表示 | | 10–11 | 年表、用語集 | 2011〜2026 年の STS の歴史、EN/JA の用語 43 個 | -数値の裏付けは [`docs/`](docs/README.md) に出典付きでまとめています。2026-10-10 時点の AWS ドキュメント、What's New、AWS SDK のエンドポイントデータ、GitHub の changelog で確認しました。AWS の情報源同士で食い違う箇所は、その旨を書いています。 +数値の裏付けは [`docs/`](docs/README.md) に出典付きでまとめています。2026-11-11 時点の AWS ドキュメント、What's New、AWS SDK のエンドポイントデータ、GitHub の changelog で確認しました。AWS の情報源同士で食い違う箇所は、その旨を書いています。 署名の章では、本物の SigV4 / SigV4a 実装 (WebCrypto と `@noble/curves`) をブラウザ内で動かします。テストでは AWS が公開している署名の計算例とバイト単位で照合しています。その確かめ方と、途中で見つけた AWS ドキュメントの誤りは [`docs/signing/`](docs/signing/README.ja.md) にあります。この章とノートは、2026-11-08 に統合した旧 `caller-identity` プロジェクトから移したものです。 diff --git a/README.md b/README.md index 5cf76e0..b786539 100644 --- a/README.md +++ b/README.md @@ -27,7 +27,7 @@ This repository was called `assume-role` until 2026-11-08, when the former `call | 9 | Errors | Paste an error message and get the cause and the fix | | 10–11 | Timeline, glossary | STS history 2011–2026, 43 terms in EN/JA | -The research behind every number lives in [`docs/`](docs/README.md), with sources. Facts were checked against AWS documentation, What's New posts, the AWS SDK endpoint data and the GitHub changelog on 2026-10-10. Where AWS sources disagree, the docs say so. +The research behind every number lives in [`docs/`](docs/README.md), with sources. Facts were checked against AWS documentation, What's New posts, the AWS SDK endpoint data and the GitHub changelog on 2026-11-11. Where AWS sources disagree, the docs say so. The Signing chapter runs a real SigV4 and SigV4a implementation in the browser (WebCrypto plus `@noble/curves`). Its tests assert it byte for byte against the signature examples AWS publishes; how that was checked, and an error found in the AWS documentation along the way, is in [`docs/signing/`](docs/signing/README.md). That chapter and its notes came from the former `caller-identity` project, merged in on 2026-11-08. diff --git a/docs/02-endpoints.md b/docs/02-endpoints.md index 9458257..0ebe8ab 100644 --- a/docs/02-endpoints.md +++ b/docs/02-endpoints.md @@ -1,6 +1,6 @@ # AWS STS Endpoints Deep Dive -_Last verified: 2026-10-10. Every claim links to its source. Anything not confirmed in official AWS material is marked "(unverified)". Where AWS documents disagree with each other, both are quoted._ +_Last verified: 2026-11-11. Every claim links to its source. Anything not confirmed in official AWS material is marked "(unverified)". Where AWS documents disagree with each other, both are quoted._ ## TL;DR @@ -268,7 +268,7 @@ Dual-stack limitations: "IPv6 clients are not supported on the global endpoint ` ### Other partitions -Credentials never cross partitions. The AWS European Sovereign Cloud landing-zone guidance states plainly that `sts:AssumeRole` is "Not available across the aws and aws-eusc boundary" ([AWS Security Blog: ESC landing zone](https://aws.amazon.com/blogs/security/architecting-a-secure-landing-zone-in-the-aws-european-sovereign-cloud/)). Non-commercial partitions "must use Regional endpoints" ([SDK Reference](https://docs.aws.amazon.com/sdkref/latest/guide/feature-sts-regionalized-endpoints.html)). +A credential issued in one partition is not valid in another, so `AssumeRole` does not work across a partition boundary. The AWS European Sovereign Cloud landing-zone guidance states plainly that `sts:AssumeRole` is "Not available across the aws and aws-eusc boundary" ([AWS Security Blog: ESC landing zone](https://aws.amazon.com/blogs/security/architecting-a-secure-landing-zone-in-the-aws-european-sovereign-cloud/)). Since November 2026 the supported way across is cross-partition identity federation: call `GetWebIdentityToken` in the source partition and exchange the JWT with `AssumeRoleWithWebIdentity` at a Regional endpoint in the destination partition (`aws`, `aws-cn`, `aws-us-gov`, `aws-eusc`; [IAM User Guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_outbound_cross_partition.html), [What's New](https://aws.amazon.com/about-aws/whats-new/2026/11/aws-sts-cross-partition/)). Non-commercial partitions "must use Regional endpoints" ([SDK Reference](https://docs.aws.amazon.com/sdkref/latest/guide/feature-sts-regionalized-endpoints.html)). | Partition | Regions | Regional endpoint | Dual-stack | FIPS | Source | | --- | --- | --- | --- | --- | --- | diff --git a/docs/05-credential-paths.md b/docs/05-credential-paths.md index 70c0caf..8fbaf0e 100644 --- a/docs/05-credential-paths.md +++ b/docs/05-credential-paths.md @@ -1,6 +1,6 @@ # Credential Paths: How Workloads and Humans Actually Get STS Credentials -_Last verified: 2026-10-10_ +_Last verified: 2026-11-11_ Every AWS API call that is not anonymous is signed with SigV4 using an access key. Short-term keys (`ASIA...` access key ID plus a session token) almost always come out of AWS STS, but not always from a call that _your_ code makes. This chapter walks through each delivery path end to end: who calls what, which endpoint is hit, what the token looks like, how long the result lives, and where people trip. @@ -384,6 +384,7 @@ Ext svc -> Ext svc : verify signature, iss, aud, sub, exp; map claims to pe - Parameters: `Audience` 1 to 10 values; `DurationSeconds` 60 to 3600, default 300; `SigningAlgorithm` `RS256` or `ES384` (required); up to 50 `Tags`. Not available on the STS global endpoint. Errors include `OutboundWebIdentityFederationDisabled` and `SessionDurationEscalation` (a token cannot outlive the calling session) ([API reference](https://docs.aws.amazon.com/STS/latest/APIReference/API_GetWebIdentityToken.html)). - Claims: standard `iss`, `aud`, `sub` (principal ARN), `iat`, `exp`, `jti`; under the `https://sts.amazonaws.com/` namespace: `aws_account`, `source_region`, `org_id`, `ou_path`, `principal_tags`, `request_tags`, and context such as `ec2_source_instance_arn`, `ec2_instance_source_vpc`, `ec2_role_delivery`, `lambda_source_function_arn`, `identity_store_user_id`, `federated_provider`, `source_identity`, `original_session_exp`, `glue_credential_issuing_service` ([token claims](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_outbound_token_claims.html)). - Control: `sts:GetWebIdentityToken` permission plus condition keys `sts:IdentityTokenAudience`, `sts:SigningAlgorithm`, `sts:DurationSeconds`, usable in identity policies, SCPs, RCPs and VPC endpoint policies ([AWS News Blog](https://aws.amazon.com/blogs/aws/simplify-access-to-external-services-using-aws-iam-outbound-identity-federation/)). +- Cross-partition (since 2026-11): the destination partition's STS can be the relying party. Create an IAM OIDC provider there for the source account's issuer URL, request the token with exactly one `Audience`, and call `AssumeRoleWithWebIdentity` at a Regional endpoint in the destination partition. Tokens are rejected for `AssumeRoleWithWebIdentity` in the same partition (use `AssumeRole`). Session requests carry `aws:CrossPartitionSourceRegion`; CloudTrail links both sides through `webIdentityTokenId` ([IAM User Guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_outbound_cross_partition.html), [What's New](https://aws.amazon.com/about-aws/whats-new/2026/11/aws-sts-cross-partition/)). - Pitfall: external services must pin the account-specific `iss` _and_ check `sub`/`aud`; trusting all of `*.tokens.sts.global.api.aws` would trust every AWS account. ### Centralized Root Access (`AssumeRoot`) @@ -518,6 +519,7 @@ web_identity_token_file = /var/run/secrets/token - [AWS News Blog: IAM outbound identity federation](https://aws.amazon.com/blogs/aws/simplify-access-to-external-services-using-aws-iam-outbound-identity-federation/) - [IAM: Outbound token claims](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_outbound_token_claims.html) - [IAM: Federating AWS identities to external services](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_outbound.html) +- [IAM: Federating AWS identities across AWS partitions](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_outbound_cross_partition.html) - [Security Blog: Centralized root access](https://aws.amazon.com/blogs/security/secure-root-user-access-for-member-accounts-in-aws-organizations/) - [SDKs and Tools: Standardized credential providers](https://docs.aws.amazon.com/sdkref/latest/guide/standardized-credentials.html) - [SDKs and Tools: Container credential provider](https://docs.aws.amazon.com/sdkref/latest/guide/feature-container-credentials.html) diff --git a/docs/07-timeline.md b/docs/07-timeline.md index b9daa83..8388a95 100644 --- a/docs/07-timeline.md +++ b/docs/07-timeline.md @@ -1,8 +1,8 @@ # AWS STS Timeline -_Last verified: 2026-10-10_ +_Last verified: 2026-11-11_ -This timeline lists the AWS Security Token Service (STS) launches and behavior changes that matter for design and operations, from the 2011 launch to October 2026. Each entry links to a primary source where one exists. Dates come from AWS What's New posts, AWS blogs, or the API reference. Entries marked "(unverified)" could not be tied to an official AWS source. +This timeline lists the AWS Security Token Service (STS) launches and behavior changes that matter for design and operations, from the 2011 launch to November 2026. Each entry links to a primary source where one exists. Dates come from AWS What's New posts, AWS blogs, or the API reference. Entries marked "(unverified)" could not be tied to an official AWS source. ## At a glance @@ -30,6 +30,7 @@ This timeline lists the AWS Security Token Service (STS) launches and behavior c | 2026-02 | IdP-specific OIDC claims as condition keys | Fine-grained GitHub, Google, CircleCI, OCI trust | | 2026-08 | Outbound identity federation in the AWS European Sovereign Cloud | Sovereign Region support | | 2026-09 | Single 4,096-byte session token limit with metrics; VPC endpoints for OIDC discovery | Predictable `PackedPolicyTooLarge`; private JWKS | +| 2026-11 | Cross-partition identity federation | Temporary credentials across partitions without IAM user keys | ## Detailed entries @@ -84,8 +85,9 @@ This timeline lists the AWS Security Token Service (STS) launches and behavior c - 2026-08: outbound identity federation becomes available in the AWS European Sovereign Cloud Region ([What's New](https://aws.amazon.com/about-aws/whats-new/2026/08/aws-iam-european-sovereign-cloud/)). - 2026-09: one 4,096-byte session token limit replaces the separate packed-policy and token limits. Responses add `SessionTokenSize` and `SessionTokenUtilization` (`PackedPolicySize` is deprecated). CloudWatch gains `AWS/STS` metrics, and the `MinimumSessionTokenSize` parameter supports testing ([What's New](https://aws.amazon.com/about-aws/whats-new/2026/09/aws-sts/), [AWS Security Blog](https://aws.amazon.com/blogs/security/aws-sts-simplifies-session-token-size-limits-and-adds-session-token-size-monitoring/)). - 2026-09: interface VPC endpoints for the outbound identity federation OIDC discovery and JWKS endpoints ([What's New](https://aws.amazon.com/about-aws/whats-new/2026/09/aws-sts-vpc-oidc/)). +- 2026-11: cross-partition identity federation. A workload exchanges a `GetWebIdentityToken` JWT from its own partition for credentials in another partition with `AssumeRoleWithWebIdentity`, across `aws`, `aws-cn`, `aws-us-gov`, and `aws-eusc` ([What's New](https://aws.amazon.com/about-aws/whats-new/2026/11/aws-sts-cross-partition/), [IAM User Guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_outbound_cross_partition.html)). -## Current API surface (2026-10) +## Current API surface (2026-11) The STS API Reference lists 11 actions: `AssumeRole`, `AssumeRoleWithSAML`, `AssumeRoleWithWebIdentity`, `AssumeRoot`, `DecodeAuthorizationMessage`, `GetAccessKeyInfo`, `GetCallerIdentity`, `GetDelegatedAccessToken`, `GetFederationToken`, `GetSessionToken`, and `GetWebIdentityToken` ([STS API Reference: Actions](https://docs.aws.amazon.com/STS/latest/APIReference/API_Operations.html)). @@ -135,6 +137,7 @@ The STS API Reference lists 11 actions: `AssumeRole`, `AssumeRoleWithSAML`, `Ass - [What's New 2026-09: STS session token size limits](https://aws.amazon.com/about-aws/whats-new/2026/09/aws-sts/) - [AWS Security Blog: AWS STS simplifies session token size limits](https://aws.amazon.com/blogs/security/aws-sts-simplifies-session-token-size-limits-and-adds-session-token-size-monitoring/) - [What's New 2026-09: VPC endpoints for OIDC discovery](https://aws.amazon.com/about-aws/whats-new/2026/09/aws-sts-vpc-oidc/) +- [What's New 2026-11: STS cross-partition federation](https://aws.amazon.com/about-aws/whats-new/2026/11/aws-sts-cross-partition/) - [STS API Reference: Actions](https://docs.aws.amazon.com/STS/latest/APIReference/API_Operations.html) - [STS API Reference: AssumeRoot](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoot.html) - [STS API Reference: GetWebIdentityToken](https://docs.aws.amazon.com/STS/latest/APIReference/API_GetWebIdentityToken.html) diff --git a/src/data/asOf.ts b/src/data/asOf.ts index c0ad2e0..4311faf 100644 --- a/src/data/asOf.ts +++ b/src/data/asOf.ts @@ -1,2 +1,2 @@ /** Date the facts on the site were last checked against AWS documentation. */ -export const AS_OF = "2026-10-10"; +export const AS_OF = "2026-11-11"; diff --git a/src/features/api/ops.ts b/src/features/api/ops.ts index a190b58..3ba2fda 100644 --- a/src/features/api/ops.ts +++ b/src/features/api/ops.ts @@ -568,8 +568,8 @@ export const OPS: Op[] = [ regionalOnly: true, since: 2025, purpose: { - en: "Outbound identity federation: get a JWT signed by AWS that proves who your workload is to an external service supporting OIDC. It returns no AWS credentials.", - ja: "アウトバウンド ID フェデレーション: ワークロードの身元を外部の OIDC 対応サービスに証明する、AWS 署名の JWT を得ます。AWS の認証情報は返しません。", + en: "Outbound identity federation: get a JWT signed by AWS that proves who your workload is to an external service supporting OIDC, or (since November 2026) to STS in another AWS partition via `AssumeRoleWithWebIdentity`. It returns no AWS credentials.", + ja: "アウトバウンド ID フェデレーション: ワークロードの身元を外部の OIDC 対応サービスに、または (2026 年 11 月から) `AssumeRoleWithWebIdentity` で別パーティションの STS に証明する、AWS 署名の JWT を得ます。AWS の認証情報は返しません。", }, caller: { en: "An IAM role or user, typically a workload on EC2 or Lambda. The account must first run IAM `EnableOutboundWebIdentityFederation`, which creates its issuer URL.", diff --git a/src/features/endpoints/decide.ts b/src/features/endpoints/decide.ts index b0b4fe4..5c7631d 100644 --- a/src/features/endpoints/decide.ts +++ b/src/features/endpoints/decide.ts @@ -24,8 +24,8 @@ export function decide(a: Answers): Decision { asked: ["commercial"], host: "sts..", why: { - en: "China, GovCloud, the European Sovereign Cloud and ISO partitions have no global endpoint. Use that partition's Regional endpoint; credentials never cross partitions.", - ja: "中国・GovCloud・European Sovereign Cloud・ISO にはグローバルエンドポイントがありません。そのパーティションのリージョナルを使います。認証情報はパーティションをまたげません。", + en: "China, GovCloud, the European Sovereign Cloud and ISO partitions have no global endpoint. Use that partition's Regional endpoint. Credentials from one partition are not valid in another; to reach another partition, exchange a `GetWebIdentityToken` JWT with `AssumeRoleWithWebIdentity` there (cross-partition federation, since November 2026).", + ja: "中国・GovCloud・European Sovereign Cloud・ISO にはグローバルエンドポイントがありません。そのパーティションのリージョナルを使います。あるパーティションの認証情報は別のパーティションでは無効です。別パーティションに入るには、`GetWebIdentityToken` の JWT を相手側の `AssumeRoleWithWebIdentity` で交換します (2026 年 11 月からのクロスパーティションフェデレーション)。", }, }; if (a.fips) { diff --git a/src/features/glossary/terms.ts b/src/features/glossary/terms.ts index 97e81ea..f515a67 100644 --- a/src/features/glossary/terms.ts +++ b/src/features/glossary/terms.ts @@ -253,8 +253,8 @@ export const TERMS: Term[] = [ term: "Outbound identity federation", aka: ["GetWebIdentityToken", "アウトバウンドフェデレーション"], def: { - en: "Since November 2025, STS can sign a JWT about your AWS principal for services outside AWS (`GetWebIdentityToken`). Regional endpoints only.", - ja: "2025 年 11 月から、STS が AWS のプリンシパルについての JWT を AWS 外のサービス向けに署名できるようになりました (`GetWebIdentityToken`)。リージョナルエンドポイントのみです。", + en: "Since November 2025, STS can sign a JWT about your AWS principal for services outside AWS (`GetWebIdentityToken`). Since November 2026 the same JWT can also be exchanged for credentials in another AWS partition. Regional endpoints only.", + ja: "2025 年 11 月から、STS が AWS のプリンシパルについての JWT を AWS 外のサービス向けに署名できるようになりました (`GetWebIdentityToken`)。2026 年 11 月からは、同じ JWT を別の AWS パーティションの認証情報に交換することもできます。リージョナルエンドポイントのみです。", }, chapter: "api", }, diff --git a/src/features/timeline/events.ts b/src/features/timeline/events.ts index 83e6157..97845d8 100644 --- a/src/features/timeline/events.ts +++ b/src/features/timeline/events.ts @@ -433,6 +433,19 @@ export const EVENTS: TimelineEvent[] = [ }, source: "https://aws.amazon.com/about-aws/whats-new/2026/09/aws-sts-vpc-oidc/", }, + { + date: "2026-11", + category: "federation", + title: { + en: "Cross-partition federation", + ja: "クロスパーティションフェデレーション", + }, + detail: { + en: "A `GetWebIdentityToken` JWT from one partition is exchanged with `AssumeRoleWithWebIdentity` for a role in another (`aws`, `aws-cn`, `aws-us-gov`, `aws-eusc`).", + ja: "あるパーティションの `GetWebIdentityToken` の JWT を、別パーティションのロールに対する `AssumeRoleWithWebIdentity` で交換できるようになりました (`aws`、`aws-cn`、`aws-us-gov`、`aws-eusc`)。", + }, + source: "https://aws.amazon.com/about-aws/whats-new/2026/11/aws-sts-cross-partition/", + }, ]; /** Comparable key: missing month or day sorts as the start of the period. */ diff --git a/src/features/trust/catalog.ts b/src/features/trust/catalog.ts index 43fe64b..fc8cd41 100644 --- a/src/features/trust/catalog.ts +++ b/src/features/trust/catalog.ts @@ -365,6 +365,19 @@ export const CATALOG: ConditionKey[] = [ ja: "ルートアクセスの一元管理のセッションであることを示します。", }, }, + { + key: "aws:CrossPartitionSourceRegion", + family: "global", + type: "String", + when: { + en: "Role sessions from cross-partition federation only (not in the trust policy)", + ja: "クロスパーティションフェデレーションのロールセッションのみ (信頼ポリシーでは使えません)", + }, + meaning: { + en: "The Region where the source partition's STS issued the `GetWebIdentityToken` JWT. Not transitive through role chaining.", + ja: "送信元パーティションの STS が `GetWebIdentityToken` の JWT を発行したリージョン。ロールチェーンには引き継がれません。", + }, + }, { key: "aws:Ec2InstanceSourceVpc", family: "global", From 6f116df86facc40abfe0cbefa1d7f4c4246a41ab Mon Sep 17 00:00:00 2001 From: kanywst <45947799+kanywst@users.noreply.github.com> Date: Wed, 11 Nov 2026 01:00:28 +0900 Subject: [PATCH 2/3] docs: cite cross-partition subpages and refresh re-checked as-of dates Address review: cite the setup, controls, auditing and condition-key pages for the single-audience rule, aws:CrossPartitionSourceRegion and the webIdentityTokenId link; add the key to the docs/04 catalogue; move the as-of markers for the 11 operations, 34 Regions and the SDK defaults table to 2026-11-11, which were re-checked and unchanged. --- docs/02-endpoints.md | 4 ++-- docs/04-sessions-and-policies.md | 1 + docs/05-credential-paths.md | 2 +- src/features/api/ops.ts | 2 +- src/features/endpoints/DepartureBoard.tsx | 4 ++-- src/features/endpoints/regions.ts | 2 +- src/features/endpoints/sdk.ts | 2 +- 7 files changed, 9 insertions(+), 8 deletions(-) diff --git a/docs/02-endpoints.md b/docs/02-endpoints.md index 0ebe8ab..19d0990 100644 --- a/docs/02-endpoints.md +++ b/docs/02-endpoints.md @@ -157,7 +157,7 @@ export AWS_STS_REGIONAL_ENDPOINTS=regional ### Default behavior per SDK (current AWS table) -From the [SDK Reference Guide](https://docs.aws.amazon.com/sdkref/latest/guide/feature-sts-regionalized-endpoints.html), as published on 2026-10-10. "Fallback" is what happens when a Regional endpoint should be used but no Region is configured. +From the [SDK Reference Guide](https://docs.aws.amazon.com/sdkref/latest/guide/feature-sts-regionalized-endpoints.html), as published on 2026-11-11 (unchanged since 2026-10-10). "Fallback" is what happens when a Regional endpoint should be used but no Region is configured. | SDK or tool | Supports setting | Default value | Default STS endpoint | Fallback with no Region | | --- | --- | --- | --- | --- | @@ -327,7 +327,7 @@ There are 34 commercial Regions: 17 default-enabled and 17 opt-in. The Region li Notes: -- The IAM "AWS STS Regions and endpoints" table, as published on 2026-10-10, omits `ap-east-2` (Taipei) and `ap-southeast-6` (New Zealand). The General Reference includes both, and the Account Management guide lists both as opt-in. +- The IAM "AWS STS Regions and endpoints" table, as published on 2026-11-11, omits `ap-east-2` (Taipei) and `ap-southeast-6` (New Zealand). The General Reference includes both, and the Account Management guide lists both as opt-in. - "Not listed" means the Region is absent from the IAM User Guide's STS VPC endpoint list, which names 33 Regions as of 2026-10-10 ([IAM: interface VPC endpoints](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_interface_vpc_endpoints.html)). Whether those five Regions actually offer the endpoint is unverified. The list may simply be stale, because the PrivateLink service catalog lists `com.amazonaws.{region}.sts` without Region restrictions ([PrivateLink: AWS services that integrate](https://docs.aws.amazon.com/vpc/latest/privatelink/aws-services-privatelink-support.html)). Check with `aws ec2 describe-vpc-endpoint-services` in the target Region. - FIPS dual-stack hostnames (`sts-fips..api.aws`) exist for the same six Regions that have FIPS. diff --git a/docs/04-sessions-and-policies.md b/docs/04-sessions-and-policies.md index 6f19dc3..3c71eb2 100644 --- a/docs/04-sessions-and-policies.md +++ b/docs/04-sessions-and-policies.md @@ -597,6 +597,7 @@ GitHub Actions trust policy pinned to one repository and branch: | `aws:userid` | String | Always | See 10.4 | | `aws:PrincipalArn` | ARN | Signed requests | Matches the **role** ARN for role sessions; not converted to unique IDs | | `aws:AssumedRoot` | Bool | Credentials from `AssumeRoot` only | Distinguish centralized root sessions | +| `aws:CrossPartitionSourceRegion` | String | Role sessions from cross-partition federation (`AssumeRoleWithWebIdentity` with a `GetWebIdentityToken` JWT); not in the trust-policy evaluation; not transitive through role chaining | SCP/RCP/identity-policy deny by the Region that issued the token (in the trust policy, use `issuer-host:source_region`) | | `aws:Ec2InstanceSourceVpc` | String | Requests signed with EC2 role credentials | Pin credentials to the VPC they were delivered to | | `aws:Ec2InstanceSourcePrivateIPv4` | IP | Requests signed with EC2 role credentials | Pin to delivery IP; always pair with the VPC key | | `aws:SourceArn`, `aws:SourceAccount` | ARN / String | Service-principal requests on behalf of a resource | Cross-service confused deputy | diff --git a/docs/05-credential-paths.md b/docs/05-credential-paths.md index 8fbaf0e..32e4bbc 100644 --- a/docs/05-credential-paths.md +++ b/docs/05-credential-paths.md @@ -384,7 +384,7 @@ Ext svc -> Ext svc : verify signature, iss, aud, sub, exp; map claims to pe - Parameters: `Audience` 1 to 10 values; `DurationSeconds` 60 to 3600, default 300; `SigningAlgorithm` `RS256` or `ES384` (required); up to 50 `Tags`. Not available on the STS global endpoint. Errors include `OutboundWebIdentityFederationDisabled` and `SessionDurationEscalation` (a token cannot outlive the calling session) ([API reference](https://docs.aws.amazon.com/STS/latest/APIReference/API_GetWebIdentityToken.html)). - Claims: standard `iss`, `aud`, `sub` (principal ARN), `iat`, `exp`, `jti`; under the `https://sts.amazonaws.com/` namespace: `aws_account`, `source_region`, `org_id`, `ou_path`, `principal_tags`, `request_tags`, and context such as `ec2_source_instance_arn`, `ec2_instance_source_vpc`, `ec2_role_delivery`, `lambda_source_function_arn`, `identity_store_user_id`, `federated_provider`, `source_identity`, `original_session_exp`, `glue_credential_issuing_service` ([token claims](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_outbound_token_claims.html)). - Control: `sts:GetWebIdentityToken` permission plus condition keys `sts:IdentityTokenAudience`, `sts:SigningAlgorithm`, `sts:DurationSeconds`, usable in identity policies, SCPs, RCPs and VPC endpoint policies ([AWS News Blog](https://aws.amazon.com/blogs/aws/simplify-access-to-external-services-using-aws-iam-outbound-identity-federation/)). -- Cross-partition (since 2026-11): the destination partition's STS can be the relying party. Create an IAM OIDC provider there for the source account's issuer URL, request the token with exactly one `Audience`, and call `AssumeRoleWithWebIdentity` at a Regional endpoint in the destination partition. Tokens are rejected for `AssumeRoleWithWebIdentity` in the same partition (use `AssumeRole`). Session requests carry `aws:CrossPartitionSourceRegion`; CloudTrail links both sides through `webIdentityTokenId` ([IAM User Guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_outbound_cross_partition.html), [What's New](https://aws.amazon.com/about-aws/whats-new/2026/11/aws-sts-cross-partition/)). +- Cross-partition (since 2026-11): the destination partition's STS can be the relying party. Create an IAM OIDC provider there for the source account's issuer URL, request the token with exactly one `Audience` (multi-audience tokens are rejected; [setup](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_outbound_cross_partition_setup.html), [controls](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_outbound_cross_partition_controls.html)), and call `AssumeRoleWithWebIdentity` at a Regional endpoint in the destination partition. Tokens are rejected for `AssumeRoleWithWebIdentity` in the same partition (use `AssumeRole`). Session requests carry `aws:CrossPartitionSourceRegion` ([global condition keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html)); CloudTrail links both sides through `webIdentityTokenId` ([auditing](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_outbound_cross_partition_auditing.html), [IAM User Guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_outbound_cross_partition.html), [What's New](https://aws.amazon.com/about-aws/whats-new/2026/11/aws-sts-cross-partition/)). - Pitfall: external services must pin the account-specific `iss` _and_ check `sub`/`aud`; trusting all of `*.tokens.sts.global.api.aws` would trust every AWS account. ### Centralized Root Access (`AssumeRoot`) diff --git a/src/features/api/ops.ts b/src/features/api/ops.ts index 3ba2fda..5384bf1 100644 --- a/src/features/api/ops.ts +++ b/src/features/api/ops.ts @@ -1,7 +1,7 @@ import type { L } from "@/i18n/lang"; /** - * Every operation in the STS API Reference (11 as of 2026-10-10), with the + * Every operation in the STS API Reference (11 as of 2026-11-11), with the * facts the chapter draws. Source: docs/03-api-operations.md, which cites the * API Reference page for each one. Values marked unverified there are either * left out here or labelled in the copy. diff --git a/src/features/endpoints/DepartureBoard.tsx b/src/features/endpoints/DepartureBoard.tsx index 161798f..a9bfef6 100644 --- a/src/features/endpoints/DepartureBoard.tsx +++ b/src/features/endpoints/DepartureBoard.tsx @@ -30,8 +30,8 @@ export function DepartureBoard() { ja: "全リージョンの窓口を一枚のボードに", }} hint={{ - en: "All 34 commercial Regions as of 2026-10-10. Type to filter by code or name, and switch which hostname family the board shows.", - ja: "2026-10-10 時点の商用 34 リージョンです。コードや名前で絞り込み、表示するホスト名の種類を切り替えられます。", + en: "All 34 commercial Regions as of 2026-11-11. Type to filter by code or name, and switch which hostname family the board shows.", + ja: "2026-11-11 時点の商用 34 リージョンです。コードや名前で絞り込み、表示するホスト名の種類を切り替えられます。", }} >
diff --git a/src/features/endpoints/regions.ts b/src/features/endpoints/regions.ts index d8f3d90..454f91c 100644 --- a/src/features/endpoints/regions.ts +++ b/src/features/endpoints/regions.ts @@ -1,7 +1,7 @@ import type { L } from "@/i18n/lang"; /** - * The 34 commercial Regions as of 2026-10-10 (docs/02-endpoints.md, "Commercial + * The 34 commercial Regions as of 2026-11-11 (docs/02-endpoints.md, "Commercial * Region endpoint table"). Hostnames are not stored: they follow one pattern per * family, built in hostname.ts, so the table cannot drift from the builder. */ diff --git a/src/features/endpoints/sdk.ts b/src/features/endpoints/sdk.ts index 5c6c091..19bab96 100644 --- a/src/features/endpoints/sdk.ts +++ b/src/features/endpoints/sdk.ts @@ -4,7 +4,7 @@ import { GLOBAL_HOST, regionalHost } from "./model"; /** * Which STS hostname each SDK or tool calls, from the SDK Reference Guide table - * (as of 2026-10-10) corrected by the 2025-07-31 release announcements for + * (as of 2026-11-11) corrected by the 2025-07-31 release announcements for * Boto3 1.40.0 and AWS CLI v1 1.42.0. See docs/02-endpoints.md. */ From 6faea43cd02f714b320deb51a4504e071594480b Mon Sep 17 00:00:00 2001 From: kanywst <45947799+kanywst@users.noreply.github.com> Date: Wed, 11 Nov 2026 01:05:24 +0900 Subject: [PATCH 3/3] docs: source the aws:CrossPartitionSourceRegion row and bump docs/03 check date --- docs/03-api-operations.md | 2 +- docs/04-sessions-and-policies.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/03-api-operations.md b/docs/03-api-operations.md index 749faa4..61cff92 100644 --- a/docs/03-api-operations.md +++ b/docs/03-api-operations.md @@ -1,6 +1,6 @@ # AWS STS API Operations: Complete Reference -_Last verified: 2026-10-10 against the AWS STS API Reference (last published 2026-10-09), the IAM User Guide, the Service Authorization Reference, and AWS What's New posts._ +_Last verified: 2026-11-11 against the AWS STS API Reference (last published 2026-11-10), the IAM User Guide, the Service Authorization Reference, and AWS What's New posts._ This chapter goes through every operation in the AWS Security Token Service (STS) API one by one. For each operation it covers who calls it, how the call is authenticated, its parameters and limits, what it returns, how long the result lasts, how it handles MFA, and what the resulting session can and cannot do. Each claim cites an official source inline. Anything that could not be confirmed against official documentation is marked **(unverified)**. diff --git a/docs/04-sessions-and-policies.md b/docs/04-sessions-and-policies.md index 3c71eb2..44259db 100644 --- a/docs/04-sessions-and-policies.md +++ b/docs/04-sessions-and-policies.md @@ -597,7 +597,7 @@ GitHub Actions trust policy pinned to one repository and branch: | `aws:userid` | String | Always | See 10.4 | | `aws:PrincipalArn` | ARN | Signed requests | Matches the **role** ARN for role sessions; not converted to unique IDs | | `aws:AssumedRoot` | Bool | Credentials from `AssumeRoot` only | Distinguish centralized root sessions | -| `aws:CrossPartitionSourceRegion` | String | Role sessions from cross-partition federation (`AssumeRoleWithWebIdentity` with a `GetWebIdentityToken` JWT); not in the trust-policy evaluation; not transitive through role chaining | SCP/RCP/identity-policy deny by the Region that issued the token (in the trust policy, use `issuer-host:source_region`) | +| `aws:CrossPartitionSourceRegion` | String | Role sessions from cross-partition federation (`AssumeRoleWithWebIdentity` with a `GetWebIdentityToken` JWT); not in the trust-policy evaluation; not transitive through role chaining | SCP/RCP/identity-policy deny by the Region that issued the token (the trust policy cannot see this key; to filter by source Region before credentials are issued, use `issuer-host:source_region` there) ([global condition keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html), [cross-partition controls](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_outbound_cross_partition_controls.html)) | | `aws:Ec2InstanceSourceVpc` | String | Requests signed with EC2 role credentials | Pin credentials to the VPC they were delivered to | | `aws:Ec2InstanceSourcePrivateIPv4` | IP | Requests signed with EC2 role credentials | Pin to delivery IP; always pair with the VPC key | | `aws:SourceArn`, `aws:SourceAccount` | ARN / String | Service-principal requests on behalf of a resource | Cross-service confused deputy |