or run

npx @tessl/cli init
Log in

Version

Tile

Overview

Evals

Files

docs

client-management.mdfederation.mdindex.mdrole-assumption.mdsession-tokens.mdutilities.md
tile.json

tessl/maven-com-amazonaws--aws-java-sdk-sts

Java client library for Amazon Web Services Security Token Service (AWS STS) enabling temporary security credentials and federated user access

Workspace
tessl
Visibility
Public
Created
Last updated
Describes
mavenpkg:maven/com.amazonaws/aws-java-sdk-sts@1.12.x

To install, run

npx @tessl/cli install tessl/maven-com-amazonaws--aws-java-sdk-sts@1.12.0

index.mddocs/

AWS Security Token Service (STS) SDK

The AWS Java SDK for AWS STS provides comprehensive client libraries for communicating with Amazon Web Services Security Token Service. This service enables applications to request temporary, limited-privilege credentials for users, supporting various authentication mechanisms including role assumption, SAML federation, web identity federation, and multi-factor authentication.

Package Information

  • Package Name: aws-java-sdk-sts
  • Package Type: Maven
  • Language: Java
  • Group ID: com.amazonaws
  • Artifact ID: aws-java-sdk-sts
  • Version: 1.12.789
  • Installation: 
    <dependency>
  <groupId>com.amazonaws</groupId>
  <artifactId>aws-java-sdk-sts</artifactId>
  <version>1.12.789</version>
</dependency>

Core Imports

import com.amazonaws.services.securitytoken.AWSSecurityTokenService;
import com.amazonaws.services.securitytoken.AWSSecurityTokenServiceClientBuilder;
import com.amazonaws.services.securitytoken.model.*;

For asynchronous operations:

import com.amazonaws.services.securitytoken.AWSSecurityTokenServiceAsync;
import com.amazonaws.services.securitytoken.AWSSecurityTokenServiceAsyncClientBuilder;

Basic Usage

import com.amazonaws.services.securitytoken.AWSSecurityTokenService;
import com.amazonaws.services.securitytoken.AWSSecurityTokenServiceClientBuilder;
import com.amazonaws.services.securitytoken.model.*;

// Create STS client
AWSSecurityTokenService stsClient = AWSSecurityTokenServiceClientBuilder
    .standard()
    .withRegion("us-east-1")
    .build();

// Get caller identity
GetCallerIdentityResult identity = stsClient.getCallerIdentity(new GetCallerIdentityRequest());
System.out.println("Account: " + identity.getAccount());
System.out.println("User ARN: " + identity.getArn());

// Assume a role
AssumeRoleRequest assumeRequest = new AssumeRoleRequest()
    .withRoleArn("arn:aws:iam::123456789012:role/MyRole")
    .withRoleSessionName("MySession")
    .withDurationSeconds(3600);

AssumeRoleResult assumeResult = stsClient.assumeRole(assumeRequest);
Credentials credentials = assumeResult.getCredentials();

System.out.println("Access Key: " + credentials.getAccessKeyId());
System.out.println("Secret Key: " + credentials.getSecretAccessKey());
System.out.println("Session Token: " + credentials.getSessionToken());

Architecture

The AWS STS SDK is built around several key components:

  • Service Interface: AWSSecurityTokenService defines all STS operations with synchronous execution
  • Async Interface: AWSSecurityTokenServiceAsync provides asynchronous versions of all operations
  • Client Implementations: Thread-safe clients (AWSSecurityTokenServiceClient, AWSSecurityTokenServiceAsyncClient) that handle HTTP communication
  • Builder Pattern: Fluent builders for configuring clients with regions, credentials, and custom settings
  • Request/Result Objects: Strongly-typed classes for all API operations with builder patterns
  • Model Classes: Data transfer objects representing AWS STS entities (credentials, users, policies)
  • Exception Hierarchy: Specific exception types for different error conditions

Capabilities

Client Management

Core client creation, configuration, and lifecycle management functionality including builders, endpoint configuration, and resource cleanup.

// Client builders
public static AWSSecurityTokenServiceClientBuilder standard();
public static AWSSecurityTokenService defaultClient();
public static AWSSecurityTokenServiceAsyncClientBuilder standard();
public static AWSSecurityTokenServiceAsync defaultClient();

// Client interface
public interface AWSSecurityTokenService {
    void setEndpoint(String endpoint);
    void setRegion(Region region);
    void shutdown();
    ResponseMetadata getCachedResponseMetadata(AmazonWebServiceRequest request);
}

Client Management

Role Assumption Operations

Core functionality for assuming IAM roles to obtain temporary credentials, including cross-account access, session policies, and MFA requirements.

AssumeRoleResult assumeRole(AssumeRoleRequest assumeRoleRequest);
AssumeRoleWithSAMLResult assumeRoleWithSAML(AssumeRoleWithSAMLRequest assumeRoleWithSAMLRequest);
AssumeRoleWithWebIdentityResult assumeRoleWithWebIdentity(AssumeRoleWithWebIdentityRequest assumeRoleWithWebIdentityRequest);

Role Assumption

Federation Operations

Federation functionality for obtaining temporary credentials through external identity providers and custom federation brokers.

GetFederationTokenResult getFederationToken(GetFederationTokenRequest getFederationTokenRequest);

Federation

Session Token Operations

Session token management for MFA-protected operations and temporary credential generation for existing IAM users.

GetSessionTokenResult getSessionToken(GetSessionTokenRequest getSessionTokenRequest);
GetSessionTokenResult getSessionToken();

Session Tokens

Utility Operations

Utility operations for debugging authorization failures, retrieving caller identity, and determining account ownership of access keys.

GetCallerIdentityResult getCallerIdentity(GetCallerIdentityRequest getCallerIdentityRequest);
GetAccessKeyInfoResult getAccessKeyInfo(GetAccessKeyInfoRequest getAccessKeyInfoRequest);
DecodeAuthorizationMessageResult decodeAuthorizationMessage(DecodeAuthorizationMessageRequest decodeAuthorizationMessageRequest);

Utilities

Core Types

public class Credentials {
    public Credentials();
    public Credentials(String accessKeyId, String secretAccessKey, String sessionToken, Date expiration);
    public String getAccessKeyId();
    public String getSecretAccessKey(); 
    public String getSessionToken();
    public Date getExpiration();
    public void setAccessKeyId(String accessKeyId);
    public void setSecretAccessKey(String secretAccessKey);
    public void setSessionToken(String sessionToken);
    public void setExpiration(Date expiration);
}

public class AssumedRoleUser {
    public String getAssumedRoleId();
    public String getArn();
    public void setAssumedRoleId(String assumedRoleId);
    public void setArn(String arn);
}

public class FederatedUser {
    public String getFederatedUserId();
    public String getArn();
    public void setFederatedUserId(String federatedUserId);
    public void setArn(String arn);
}

public class Tag {
    public String getKey();
    public String getValue();
    public void setKey(String key);
    public void setValue(String value);
}

public class PolicyDescriptorType {
    public String getArn();
    public void setArn(String arn);
}

Exception Handling

// Base exception
public class AWSSecurityTokenServiceException extends AmazonServiceException { }

// Specific exceptions
public class ExpiredTokenException extends AWSSecurityTokenServiceException { }
public class InvalidIdentityTokenException extends AWSSecurityTokenServiceException { }
public class MalformedPolicyDocumentException extends AWSSecurityTokenServiceException { }
public class PackedPolicyTooLargeException extends AWSSecurityTokenServiceException { }
public class RegionDisabledException extends AWSSecurityTokenServiceException { }
public class IDPRejectedClaimException extends AWSSecurityTokenServiceException { }
public class IDPCommunicationErrorException extends AWSSecurityTokenServiceException { }
public class InvalidAuthorizationMessageException extends AWSSecurityTokenServiceException { }