project
AWS Security Token Service issues temporary, limited-privilege credentials for IAM roles, enabling cross-account access and federated authentication.
No evidence-backed relationships are recorded.
AWS lets an S3 presigned URL live up to seven days, and anyone holding a leaked one can use it until it expires or its signer is revoked. Revoking the signer kills every URL it made, so short expiries and a bucket-level cap on signature age are the practical defence.
Reality
AWS collapsed two STS size limits into one 4,096-byte cap and now reports the assembled token's actual size in API responses, CloudWatch and CloudTrail, with a new parameter that pads tokens for testing.
Reality
Benchling runs agent-written scientific code in a separate AWS account with no internet gateway and no NAT gateway, so the remaining way out of the VPC was a name lookup. The resolver policy answers the endpoints Benchling listed and blocks everything else.
Reality
One practitioner's account of moving three Jenkins fleets onto AssumeRoleWithWebIdentity lists the same mistakes every time, and two of them leave the build lights green.
Reality
AWS patched seven SDKs and called it a defense-in-depth enhancement. Pi says all seven third-party deployments it tested handed over live credentials, which puts the region field on your audit list.
Reality
A time-based deny on aws:TokenIssueTime invalidates every credential the role already handed out while the running fleet refreshes through it. The stolen session outlives the patch window by 90 minutes.
Reality
The November 1, 2026 SDK retry defaults change behaviour under partial failure with no code change on your side. One author's synthetic run projects failures going from 6 to 27 per 1,428 calls.
Reality
A clean STS exchange proves only that IAM let the job in. EKS authorizes separately, and that is the half of the migration most walkthroughs skip.
Reality
A developer audited the IAM policy on his own Bedrock agent and found one statement scoped to a single secret and another that reaches every Claude model, in every region Bedrock runs.
Reality