Assume a role with STS

Temporary credentials from STS are how engineers and automation cross account and permission boundaries without long-lived keys. Understand what a role is, how its trust policy decides who may step into it, what the three-part temporary credential set contains, and how a tool like aws-vault automates the whole handoff.