Security & identity
AWS Security Token Service (STS)
- Timenot billed
- Bytesnot billed
- Callsnot billed
In one line
Call AssumeRole and GetCallerIdentity as hard as you like. The STS line on your bill stays at zero.
This service turns no meters of its own. Read the trap below for what it makes you pay for elsewhere.
What gets missed
Every STS call is a CloudTrail management event. A tight AssumeRole loop costs nothing at STS and shows up as real money in GuardDuty event analysis and in any trail beyond your first.
Bills the same way
These services turn exactly the same meters, so what you learn here transfers.