What authentication does the AWS Security Token Service use?

STS uses AWS Signature Version 4 (SigV4): an HMAC-SHA256 signature over the request, sent in the Authorization header. Through Jentic, your AWS access key ID and secret access key sit encrypted in the vault and Jentic computes the SigV4 signature for each call, so the raw secret never enters the agent's context.

Can I use STS to grant cross-account access to an external partner?

Yes. Create an IAM role in your account whose trust policy lists the partner's AWS account ID (and optionally an ExternalId), then have the partner call AssumeRole with that RoleArn. They receive temporary credentials scoped to that role's permissions, with no long-term keys exchanged.

What are the rate limits for the AWS Security Token Service?

STS has a default account-level rate of around 600 transactions per second per region for AssumeRole and similar actions, with higher limits available on request. The regional STS endpoint (sts.us-east-1.amazonaws.com style) gives lower latency than the global sts.amazonaws.com endpoint.

How do I assume a role through Jentic?

Search Jentic with the intent 'assume an aws iam role', load the schema for AssumeRole, and execute with RoleArn, RoleSessionName, and an optional DurationSeconds. Jentic returns the temporary AccessKeyId, SecretAccessKey, and SessionToken in a structured response.

Is AWS STS free to use?

Yes. STS itself has no charge; you pay only for the underlying AWS resources the temporary credentials are used to access.

What is the difference between AssumeRole and GetSessionToken?

AssumeRole switches into a different IAM role (often in another account) and returns credentials with that role's permissions. GetSessionToken keeps the same identity as the calling user but returns short-lived credentials, typically used to satisfy an MFA requirement before performing a privileged action.

Can I limit what my agent is allowed to do with the AWS Security Token Service API?

Yes. Because Jentic One is self-hosted, you run your own instance and your own rules decide which STS operations and credentials the agent may use. STS selects behaviour by an Action parameter rather than resource IDs in the path, so you can scope the agent to only the operations it needs, such as GetCallerIdentity and GetSessionToken. Credential-minting actions like AssumeRole are not available to the agent unless you explicitly add them, and your AWS access keys stay encrypted on your instance and are used only to sign each request.