STS
A service mechanism that issues temporary, limited-privilege credentials on demand. Callers exchange a long-term identity for temporary credentials usually valid from fifteen minutes to several hours, which carry their own expiration time and permission scope, thereby limiting the attack window in the event of credential leakage.
Timeline (last 90 days)
Short-term tokens are issued through mechanisms such as STS (Security Token Service), with validity periods ranging from a few minutes to a few hours, and are bound to specific permission scopes, so an attacker who obtains an expired token cannot reuse it.
An IAM role is a core mechanism in cloud platforms (such as AWS, Azure, GCP) for defining identity permissions; it is a set of permission policies, usually used together with temporary security credentials, with access keys dynamically issued via STS.
Credential management can be implemented through short-term credentials (such as dynamic issuance via STS), a Credential Broker holding long-term keys, and network-layer outbound policies, with the core logic being to move credentials out of the Agent process.
STS (Security Token Service) is a service that issues temporary, limited-permission credentials on demand, typically represented by AWS STS, and temporary credentials are usually valid from 15 minutes to several hours.
Among the ten environments tested in the paper, seven could not apply statistical synthesizers due to hard requirements for seed data.
The SAP team fully open-sourced the entire STS framework, all ten simulation environments, and the generated datasets, with code hosted on GitHub.
Even agents with schema privileges had a failure rate as high as 82% on trajectories in the aviation industry environment's tightly coupled workflows, due to the fragility of task combinations.
STS adopts a schema-free design that does not rely on direct access to database structures; instead, LLM agents generate data by calling policy-enforcing APIs within a simulated enterprise environment.
Because data is generated through the same environment that defines legality, STS structurally guarantees structural validity and decouples legality enforcement from distribution modeling.
STS introduces the Generalist Populator (GP), a domain-agnostic population agent.
2 more timeline events
All Facts (12)
Short-term tokens are issued through mechanisms such as STS (Security Token Service), with validity periods ranging from a few minutes to a few hours, and are bound to specific permission scopes, so an attacker who obtains an expired token cannot reuse it.
50%UnverifiedAn IAM role is a core mechanism in cloud platforms (such as AWS, Azure, GCP) for defining identity permissions; it is a set of permission policies, usually used together with temporary security credentials, with access keys dynamically issued via STS.
50%UnverifiedSTS (Security Token Service) is a service that issues temporary, limited-permission credentials on demand, typically represented by AWS STS, and temporary credentials are usually valid from 15 minutes to several hours.
50%UnverifiedCredential management can be implemented through short-term credentials (such as dynamic issuance via STS), a Credential Broker holding long-term keys, and network-layer outbound policies, with the core logic being to move credentials out of the Agent process.
50%UnverifiedAmong the ten environments tested in the paper, seven could not apply statistical synthesizers due to hard requirements for seed data.
50%UnverifiedEven agents with schema privileges had a failure rate as high as 82% on trajectories in the aviation industry environment's tightly coupled workflows, due to the fragility of task combinations.
50%UnverifiedSTS adopts a schema-free design that does not rely on direct access to database structures; instead, LLM agents generate data by calling policy-enforcing APIs within a simulated enterprise environment.
50%UnverifiedBecause data is generated through the same environment that defines legality, STS structurally guarantees structural validity and decouples legality enforcement from distribution modeling.
50%UnverifiedSTS introduces the Generalist Populator (GP), a domain-agnostic population agent.
50%UnverifiedCross-account role assumption obtains temporary credentials for a target account's IAM role by calling STS's AssumeRole API, with temporary credentials typically valid for 15 minutes to 1 hour.
50%UnverifiedIn AWS OIDC federated identity scenarios, external workloads submit the JWT obtained from their identity provider to STS's AssumeRoleWithWebIdentity interface in exchange for temporary credentials.
50%UnverifiedThe SAP team fully open-sourced the entire STS framework, all ten simulation environments, and the generated datasets, with code hosted on GitHub.
50%