AWS STS
AWS Security Token Service, which allows AWS entities to temporarily assume IAM role permissions through an assume_role mechanism without holding long-term credentials. It supports cross-account permission delegation.
Timeline (last 90 days)
v2.1.281 adds assume_role support for the Bedrock upstream at the Claude apps gateway level, enabling calls to Bedrock by assuming an IAM role via STS, and even supporting cross-AWS-account operations.
Typical examples of short-lived credentials include AWS STS temporary tokens and OAuth 2.0 access tokens, which have explicit expiration times, usually on the order of minutes to hours
The article recommends that production-grade deployments compare trust assumption differences between managed and self-hosted solutions by referencing dynamic secret models such as AWS STS or HashiCorp Vault.
The workflow sends the OIDC token to AWS STS's AssumeRoleWithWebIdentity endpoint; after AWS verifies the signature, it compares the token claims against the role trust policy conditions, and only issues temporary credentials if all conditions are satisfied.
All Facts (4)
v2.1.281 adds assume_role support for the Bedrock upstream at the Claude apps gateway level, enabling calls to Bedrock by assuming an IAM role via STS, and even supporting cross-AWS-account operations.
50%UnverifiedTypical examples of short-lived credentials include AWS STS temporary tokens and OAuth 2.0 access tokens, which have explicit expiration times, usually on the order of minutes to hours
50%UnverifiedThe article recommends that production-grade deployments compare trust assumption differences between managed and self-hosted solutions by referencing dynamic secret models such as AWS STS or HashiCorp Vault.
50%UnverifiedThe workflow sends the OIDC token to AWS STS's AssumeRoleWithWebIdentity endpoint; after AWS verifies the signature, it compares the token claims against the role trust policy conditions, and only issues temporary credentials if all conditions are satisfied.
50%