Repository navigation
fix(content): cover STS cross-partition federation (2026-11) #23
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,6 +1,6 @@ | ||
| # Credential Paths: How Workloads and Humans Actually Get STS Credentials | ||
|
|
||
| _Last verified: 2026-11-11_ | ||
|
|
||
| Every AWS API call that is not anonymous is signed with SigV4 using an access key. Short-term keys (`ASIA...` access key ID plus a session token) almost always come out of AWS STS, but not always from a call that _your_ code makes. This chapter walks through each delivery path end to end: who calls what, which endpoint is hit, what the token looks like, how long the result lives, and where people trip. | ||
|
|
||
|
|
@@ -384,6 +384,7 @@ Ext svc -> Ext svc : verify signature, iss, aud, sub, exp; map claims to pe | |
| - Parameters: `Audience` 1 to 10 values; `DurationSeconds` 60 to 3600, default 300; `SigningAlgorithm` `RS256` or `ES384` (required); up to 50 `Tags`. Not available on the STS global endpoint. Errors include `OutboundWebIdentityFederationDisabled` and `SessionDurationEscalation` (a token cannot outlive the calling session) ([API reference](https://docs.aws.amazon.com/STS/latest/APIReference/API_GetWebIdentityToken.html)). | ||
| - Claims: standard `iss`, `aud`, `sub` (principal ARN), `iat`, `exp`, `jti`; under the `https://sts.amazonaws.com/` namespace: `aws_account`, `source_region`, `org_id`, `ou_path`, `principal_tags`, `request_tags`, and context such as `ec2_source_instance_arn`, `ec2_instance_source_vpc`, `ec2_role_delivery`, `lambda_source_function_arn`, `identity_store_user_id`, `federated_provider`, `source_identity`, `original_session_exp`, `glue_credential_issuing_service` ([token claims](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_outbound_token_claims.html)). | ||
| - Control: `sts:GetWebIdentityToken` permission plus condition keys `sts:IdentityTokenAudience`, `sts:SigningAlgorithm`, `sts:DurationSeconds`, usable in identity policies, SCPs, RCPs and VPC endpoint policies ([AWS News Blog](https://aws.amazon.com/blogs/aws/simplify-access-to-external-services-using-aws-iam-outbound-identity-federation/)). | ||
| - Cross-partition (since 2026-11): the destination partition's STS can be the relying party. Create an IAM OIDC provider there for the source account's issuer URL, request the token with exactly one `Audience` (multi-audience tokens are rejected; [setup](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_outbound_cross_partition_setup.html), [controls](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_outbound_cross_partition_controls.html)), and call `AssumeRoleWithWebIdentity` at a Regional endpoint in the destination partition. Tokens are rejected for `AssumeRoleWithWebIdentity` in the same partition (use `AssumeRole`). Session requests carry `aws:CrossPartitionSourceRegion` ([global condition keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html)); CloudTrail links both sides through `webIdentityTokenId` ([auditing](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_outbound_cross_partition_auditing.html), [IAM User Guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_outbound_cross_partition.html), [What's New](https://aws.amazon.com/about-aws/whats-new/2026/11/aws-sts-cross-partition/)). | ||
|
There was a problem hiding this comment. Some claims here read as recalled rather than sourced: the single-
Member
Author
There was a problem hiding this comment. These were read from the cited pages before 6faea43 added the links. The single audience is on the setup and controls pages ("AssumeRoleWithWebIdentity rejects tokens from GetWebIdentityToken that have more than one audience"). The same-partition rejection is on the main cross-partition page ("cannot be used for OpenID Connect (OIDC) federation into the same partition"). |
||
| - Pitfall: external services must pin the account-specific `iss` _and_ check `sub`/`aud`; trusting all of `*.tokens.sts.global.api.aws` would trust every AWS account. | ||
|
|
||
| ### Centralized Root Access (`AssumeRoot`) | ||
|
|
@@ -518,6 +519,7 @@ web_identity_token_file = /var/run/secrets/token | |
| - [AWS News Blog: IAM outbound identity federation](https://aws.amazon.com/blogs/aws/simplify-access-to-external-services-using-aws-iam-outbound-identity-federation/) | ||
| - [IAM: Outbound token claims](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_outbound_token_claims.html) | ||
| - [IAM: Federating AWS identities to external services](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_outbound.html) | ||
| - [IAM: Federating AWS identities across AWS partitions](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_outbound_cross_partition.html) | ||
| - [Security Blog: Centralized root access](https://aws.amazon.com/blogs/security/secure-root-user-access-for-member-accounts-in-aws-organizations/) | ||
| - [SDKs and Tools: Standardized credential providers](https://docs.aws.amazon.com/sdkref/latest/guide/standardized-credentials.html) | ||
| - [SDKs and Tools: Container credential provider](https://docs.aws.amazon.com/sdkref/latest/guide/feature-container-credentials.html) | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,2 +1,2 @@ | ||
| /** Date the facts on the site were last checked against AWS documentation. */ | ||
| export const AS_OF = "2026-11-11"; | ||
|
There was a problem hiding this comment.
The bump also overstates what was checked. Only the cross-partition material was re-verified. The "as of 2026-10-10" statements in
Member
Author
There was a problem hiding this comment. The date is right in local time (JST): it was already 2026-11-11 here when this was checked. The other half was fair. The 11 operations, 34 commercial Regions and the SDK defaults table were re-read today and are unchanged, so their as-of markers in There was a problem hiding this comment.
The refresh is also partial.
Member
Author
There was a problem hiding this comment. Same as before: the date is local (JST), where it is already 2026-11-11; the runner reads UTC. docs/03 was re-checked (the API Reference was last published 2026-11-10 with the same 11 actions) and now says 2026-11-11. docs/01 and docs/README are summaries of the deep dives and keep their original research date. There was a problem hiding this comment.
Member
Author
There was a problem hiding this comment. Same as the earlier threads: 2026-11-11 is the local (JST) date of the re-check, so no change. |
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
"Since November 2026" is stated as fact. The timeline entries are dated only to the month, and this sentence is a launch claim sourced to What's New URLs. Please confirm the launch date and that all four partitions (
aws,aws-cn,aws-us-gov,aws-eusc) are supported at launch."Credentials never cross partitions" was dropped here, but
AssumeRoleacross partitions is still unsupported. The new wording is fine, but the site UI (decide.ts) and the glossary now describe the exchange as an available route without any "(unverified)" marker if the page couldn't be fetched.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
What's New was posted 2026-11-09. The IAM User Guide note lists
aws,aws-cn,aws-us-govandaws-eusc, and What's New lists the same four (commercial, GovCloud (US), China, European Sovereign Cloud). Both are linked in the sentence, so no unverified marker is needed.