k9 Security now summarizes principals’ access to the STS APIs and reports whether principals may use resources, read data, or write data via the STS API. AWS Security Token Service (STS) is a service that enables you to request temporary, limited-privilege credentials to use an IAM role. k9 Security’s daily reports now contain a summary of each principal’s access to the STS APIs.
If you’re wondering which IAM principals can assume roles within an AWS account or into another account, k9 can give you a short list to review. IAM principals allowed to call one of the three
sts:AssumeRole* API actions will have the
use-resource k9 access capability.
Here’s an example of how STS access is summarized in the Principal Access Summary worksheet of k9-dev’s report (sample: xlsx):
In this example the
ci IAM user and the
use-resource capabilities to the STS API. The
k9-backend-dev has only the
Here’s how STS service actions are mapped to k9 access capabilities:
The STS API actions allowing one IAM principal to use another IAM principal are classified as
use-resource. If a principal may use other IAM principals, then two other capabilities are relevant.
read-data capability indicates an IAM principal has the ability to read information about the STS session or the account that granted it. For example,
sts:GetCallerIdentity returns the assumed role’s AWS account ID, ARN, and unique user ID. This information is very useful for debugging, security monitoring, and surveillance.
write-data capability contains API actions that enable an IAM principal to change the session or reveal debugging information from errors that occurred within the session.
We hope k9’s new STS analysis capabilities help you identify which users and roles can access other identities and are happy to answer any questions!