or run

npx @tessl/cli init
Log in

Version

Tile

Overview

Evals

Files

docs

client-operations.mdcredential-providers.mdindex.md
tile.json

tessl/maven-software-amazon-awssdk--sts

AWS Security Token Service (STS) Java SDK providing client classes for temporary credential authentication mechanisms

Workspace
tessl
Visibility
Public
Created
Last updated
Describes
mavenpkg:maven/software.amazon.awssdk/sts@2.33.x

To install, run

npx @tessl/cli install tessl/maven-software-amazon-awssdk--sts@2.33.0

index.mddocs/

AWS STS Java SDK

The AWS STS (Security Token Service) Java SDK provides comprehensive client classes for communicating with AWS Security Token Service. It enables Java applications to obtain temporary AWS credentials through various authentication mechanisms including role assumption, web identity token authentication, SAML-based authentication, and federation tokens. The SDK includes both low-level client operations and high-level credential providers with built-in session management and automatic credential refresh capabilities.

Package Information

  • Package Name: sts
  • Package Type: maven
  • Group ID: software.amazon.awssdk
  • Artifact ID: sts
  • Language: Java
  • Version: 2.33.4
  • Installation: 
    <dependency>
  <groupId>software.amazon.awssdk</groupId>
  <artifactId>sts</artifactId>
  <version>2.33.4</version>
</dependency>

Core Imports

import software.amazon.awssdk.services.sts.StsClient;
import software.amazon.awssdk.services.sts.model.*;
import software.amazon.awssdk.services.sts.auth.*;
import software.amazon.awssdk.auth.credentials.AwsCredentials;
import software.amazon.awssdk.auth.credentials.AwsCredentialsProvider;
import software.amazon.awssdk.regions.Region;

Basic Usage

Using STS Client Directly

import software.amazon.awssdk.services.sts.StsClient;
import software.amazon.awssdk.services.sts.model.*;

// Create STS client
StsClient stsClient = StsClient.builder()
    .region(Region.US_EAST_1)
    .build();

// Assume a role
AssumeRoleRequest request = AssumeRoleRequest.builder()
    .roleArn("arn:aws:iam::123456789012:role/MyRole")
    .roleSessionName("MySession")
    .durationSeconds(3600)
    .build();

AssumeRoleResponse response = stsClient.assumeRole(request);
Credentials credentials = response.credentials();

System.out.println("Access Key: " + credentials.accessKeyId());
System.out.println("Secret Key: " + credentials.secretAccessKey());
System.out.println("Session Token: " + credentials.sessionToken());

Using Credential Providers

import software.amazon.awssdk.services.sts.auth.StsAssumeRoleCredentialsProvider;
import software.amazon.awssdk.auth.credentials.AwsCredentials;

// Create credential provider
StsAssumeRoleCredentialsProvider credentialsProvider = 
    StsAssumeRoleCredentialsProvider.builder()
        .refreshRequest(AssumeRoleRequest.builder()
            .roleArn("arn:aws:iam::123456789012:role/MyRole")
            .roleSessionName("MySession")
            .build())
        .build();

// Get credentials (automatically cached and refreshed)
AwsCredentials credentials = credentialsProvider.resolveCredentials();

Architecture

The AWS STS Java SDK is organized around several key components:

  • STS Client API: Low-level client interface providing direct access to all STS operations
  • Credential Providers: High-level abstractions that automatically manage credential lifecycle
  • Model Classes: Type-safe request/response objects and data models for all STS operations
  • Authentication: Integration with AWS credential provider chains and profile systems
  • Caching: Built-in credential caching with configurable refresh behavior

Capabilities

STS Client Operations

Direct access to all AWS STS operations for temporary credential management, caller identity verification, and authorization message decoding.

public interface StsClient extends SdkClient {
    AssumeRoleResponse assumeRole(AssumeRoleRequest request);
    AssumeRoleWithSAMLResponse assumeRoleWithSAML(AssumeRoleWithSAMLRequest request);
    AssumeRoleWithWebIdentityResponse assumeRoleWithWebIdentity(AssumeRoleWithWebIdentityRequest request);
    AssumeRootResponse assumeRoot(AssumeRootRequest request);
    DecodeAuthorizationMessageResponse decodeAuthorizationMessage(DecodeAuthorizationMessageRequest request);
    GetAccessKeyInfoResponse getAccessKeyInfo(GetAccessKeyInfoRequest request);
    GetCallerIdentityResponse getCallerIdentity(GetCallerIdentityRequest request);
    GetFederationTokenResponse getFederationToken(GetFederationTokenRequest request);
    GetSessionTokenResponse getSessionToken(GetSessionTokenRequest request);
    
    static StsClientBuilder builder();
}

STS Client Operations

Credential Providers

High-level credential providers that automatically handle credential acquisition, caching, and refresh using various STS operations. Integrates seamlessly with AWS SDK credential provider chains.

public abstract class StsCredentialsProvider implements AwsCredentialsProvider {
    public abstract AwsCredentials resolveCredentials();
    public Duration staleTime();
    public Duration prefetchTime();
}

public class StsAssumeRoleCredentialsProvider extends StsCredentialsProvider {
    public static Builder builder();
}

public class StsAssumeRoleWithWebIdentityCredentialsProvider extends StsCredentialsProvider {
    public static Builder builder();
}

Credential Providers

Types

Core Data Models

public interface Credentials {
    String accessKeyId();
    String secretAccessKey();
    String sessionToken();
    Instant expiration();
}

public interface AssumedRoleUser {
    String assumedRoleId();
    String arn();
}

public interface FederatedUser {
    String federatedUserId();
    String arn();
}

public interface Tag {
    String key();
    String value();
}

Common Exceptions

public class ExpiredTokenException extends StsException {
    // Token has expired
}

public class IdpCommunicationErrorException extends StsException {
    // Identity provider communication error
}

public class IdpRejectedClaimException extends StsException {
    // Identity provider rejected claim
}

public class InvalidAuthorizationMessageException extends StsException {
    // Invalid authorization message
}

public class InvalidIdentityTokenException extends StsException {
    // Invalid identity token provided
}

public class MalformedPolicyDocumentException extends StsException {
    // Policy document is malformed
}

public class PackedPolicyTooLargeException extends StsException {
    // Policy size exceeded limit
}

public class RegionDisabledException extends StsException {
    // STS is not activated in the requested region
}