A service that issues temporary security credentials so users or services can assume IAM roles (AssumeRole, AssumeRoleWithSAML, AssumeRoleWithWebIdentity). Credentials expire automatically, reducing the risk of prolonged exposure.
In SAP-C02 it's the foundation of identity federation: a user authenticated in a SAML or OIDC IdP calls STS to obtain temporary AWS credentials without needing a permanent IAM user. Key principle: never use long-lived access keys when STS is a viable option.
AWS Security Token Service (STS) is a concept that can show up on the exam. Check the full guide to see it in context.