AWS STS for Temporary Federated Credentials
Short answer
B AWS Security Token Service (STS) is the service used to issue temporary, limited-privilege security credentials for federated access to AWS resources.
Question
Key Takeaways
The question tests the specific function of AWS STS in identity federation scenarios, distinguishing it from services that manage static secrets or certificates.
This question identifies AWS Security Token Service (STS) as the correct service for issuing temporary, limited-privilege security credentials to federated users. It establishes that STS is distinct from long-term secret management or threat detection services.
Common mistake: Learners often confuse AWS STS with AWS Secrets Manager, mistakenly believing that any service handling credentials must be the secret manager rather than the token issuer.
Expert Analysis
Why the Answer Is Correct
AWS Security Token Service (STS) is explicitly designed to provide temporary, limited-privilege credentials for accessing AWS resources. In federated scenarios, where users authenticate via external identity providers (like Active Directory or SAML), STS issues these short-lived tokens, ensuring that permanent root or IAM user keys are not exposed.
Why the Other Options Are Wrong
Amazon GuardDuty is a threat detection service, not an identity provider. AWS Secrets Manager is used for storing and rotating long-term secrets like database passwords, not for issuing temporary access tokens. AWS Certificate Manager manages SSL/TLS certificates for encryption in transit, which is unrelated to authentication or authorization credentials.
Community Comment Notes
Community consensus strongly supports B, with users noting that STS provides 'temporary, limited-privilege security credentials.' One commenter clarified that while Secrets Manager handles storage, STS handles the actual issuance of tokens, reinforcing the distinction between storage and access provision.
Exam Strategy
When asked about 'temporary' or 'federated' credentials, immediately think of STS. Distinguish this from 'secrets' (Secrets Manager) or 'certificates' (ACM). Remember that federation implies external identities needing mapped, temporary access to AWS.
Frequently Asked Questions
Why is AWS Secrets Manager incorrect for temporary credentials?
Can STS be used without federation?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
Inptic 👍 1 Answered BThe correct answer is: B. AWS Simple Token Service (AWS STS) AWS STS (Security Token Service) is used to provide temporary, limited-privilege security credentials for accessing AWS resources. These credentials are often used in federated scenarios, where users authenticate through an external identity provider (e.g., Active Directory, SAML, or social identity providers) and are granted temporary access to AWS resources. The other options are not designed for this purpose: A. Amazon GuardDuty: A threat detection service that monitors for malicious activity and unauthorized behavior. C. AWS Secrets Manager: Used to securely store and manage secrets such as database credentials, API keys, and other sensitive information. D. AWS Certificate Manager: Used to provision, manage, and deploy SSL/TLS certificates for use with AWS services.
-
its_tima 👍 1Answer is B. since C. assists with using and storing of secrets with AWS services and applications
-
d00b229 👍 1B. AWS Security Token Service (AWS STS)
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All CLF-C02 Questions
Access 120 questions with complete answers and detailed explanations.
View Full CLF-C02 Practice Test →