AWS STS for Temporary Federated Credentials
Which AWS service is used to temporarily provide federated security credentials to access AWS resources?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests the specific function of AWS STS in identity federation scenarios, distinguishing it from services that manage static secrets or certificates.
This question identifies AWS Security Token Service (STS) as the correct service for issuing temporary, limited-privilege security credentials to federated users. It establishes that STS is distinct from long-term secret management or threat detection services.
Learners often confuse AWS STS with AWS Secrets Manager, mistakenly believing that any service handling credentials must be the secret manager rather than the token issuer.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
AWS Security Token Service (STS) is explicitly designed to provide temporary, limited-privilege credentials for accessing AWS resources. In federated scenarios, where users authenticate via external identity providers (like Active Directory or SAML), STS issues these short-lived tokens, ensuring that permanent root or IAM user keys are not exposed.Why the Other Options Are Wrong
Amazon GuardDuty is a threat detection service, not an identity provider. AWS Secrets Manager is used for storing and rotating long-term secrets like database passwords, not for issuing temporary access tokens. AWS Certificate Manager manages SSL/TLS certificates for encryption in transit, which is unrelated to authentication or authorization credentials.Community Comment Notes
Community consensus strongly supports B, with users noting that STS provides 'temporary, limited-privilege security credentials.' One commenter clarified that while Secrets Manager handles storage, STS handles the actual issuance of tokens, reinforcing the distinction between storage and access provision.Exam Strategy
When asked about 'temporary' or 'federated' credentials, immediately think of STS. Distinguish this from 'secrets' (Secrets Manager) or 'certificates' (ACM). Remember that federation implies external identities needing mapped, temporary access to AWS.
Frequently Asked Questions
Why is AWS Secrets Manager incorrect for temporary credentials?
Secrets Manager stores long-term secrets like passwords. It does not issue temporary, self-expiring tokens for immediate session access like STS does.
Can STS be used without federation?
Yes, STS can provide temporary credentials for IAM roles assumed by EC2 instances or other AWS services, not just external federated users.
Related Analysis
Practice All CLF-C02 Questions
Access 120 questions with complete answers and detailed explanations.
View Full CLF-C02 Practice Test →