STS

An STS issues short-lived, temporary security credentials, often in exchange for another proof of identity such as a federated login or an assumed role. AWS STS is the best-known example, powering role assumption and cross-account access. Short-lived tokens shrink the damage window when credentials leak, which is why security guidance favors them over long-lived access keys.