--- title: How AWS IAM role, STS and Identity Pool work together description: Explains how AWS applications obtain temporary credentials by chaining together Cognito Identity Pool, AWS STS, and IAM roles. Applications first get an OIDC... canonical: https://daily.dev/posts/how-aws-iam-role-sts-and-identity-pool-work-together-bjiniv6m8 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How AWS IAM role, STS and Identity Pool work together | daily.dev og:description: Explains how AWS applications obtain temporary credentials by chaining together Cognito Identity Pool, AWS STS, and IAM roles. Applications first get an OIDC... og:url: https://daily.dev/posts/how-aws-iam-role-sts-and-identity-pool-work-together-bjiniv6m8 og:image: https://api.daily.dev/og/posts/BJINiv6m8.png og:image:alt: How AWS IAM role, STS and Identity Pool work together og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How AWS IAM role, STS and Identity Pool work together **[Teleport](https://daily.dev/sources/teleport)** · 4 min read · 0 upvotes · 0 comments ## Summary Explains how AWS applications obtain temporary credentials by chaining together Cognito Identity Pool, AWS STS, and IAM roles. Applications first get an OIDC token from a Cognito User Pool (or another IDP), then Cognito Identity Pool calls AssumeRoleWithWebIdentity against STS using that token to obtain temporary AWS credentials tied to a pre-configured IAM role and policy, which the app then uses to access AWS resources. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does AWS Cognito Identity Pool get temporary AWS credentials for an authenticated user? Cognito Identity Pool calls AssumeRoleWithWebIdentity on AWS STS, passing the OIDC token previously issued by a Cognito User Pool or other identity provider. STS then validates the token and issues temporary AWS credentials that represent the IAM role configured for authenticated users in the Identity Pool settings, along with whatever IAM policy is attached to that role. _Piecing together Cognito, STS and IAM roles gets easier with deep dives like this surfaced on daily.dev._ ## Similar posts on daily.dev - [AWS STS now supports validation of select identity provider specific claims from Google, GitHub, CircleCI and OCI](https://daily.dev/posts/aws-sts-now-supports-validation-of-select-identity-provider-specific-claims-from-google-github-cir-iwkmfdo21) · AWS · 0 upvotes · 0 comments - [Simplify access to external services using AWS IAM Outbound Identity Federation](https://daily.dev/posts/simplify-access-to-external-services-using-aws-iam-outbound-identity-federation-kfg5clfky) · AWS · 0 upvotes · 0 comments - [Rapid7 Labs: Investigating Persistence Mechanisms in AWS](https://daily.dev/posts/rapid7-labs-investigating-persistence-mechanisms-in-aws-qjvpcbpdq) · Rapid7 Cybersecurity Blog · 0 upvotes · 0 comments - [IAM Identity Center now enables programmatic AWS account access for customer managed applications](https://daily.dev/posts/iam-identity-center-now-enables-programmatic-aws-account-access-for-customer-managed-applications-jclnlquio) · AWS · 0 upvotes · 0 comments - [Connect GitHub Actions to AWS with OIDC \(No Access Keys\)](https://daily.dev/posts/connect-github-actions-to-aws-with-oidc-no-access-keys--d4kysoafb) · AWS Fundamentals · 0 upvotes · 0 comments --- Tags: [#aws](https://daily.dev/tags/aws), [#authentication](https://daily.dev/tags/authentication), [#aws-iam](https://daily.dev/tags/aws-iam) [View this post on daily.dev](https://daily.dev/posts/how-aws-iam-role-sts-and-identity-pool-work-together-bjiniv6m8) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How AWS IAM role, STS and Identity Pool work together","url":"https://daily.dev/posts/how-aws-iam-role-sts-and-identity-pool-work-together-bjiniv6m8","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-aws-iam-role-sts-and-identity-pool-work-together-bjiniv6m8"},"datePublished":"2026-08-23T12:21:58.196Z","dateModified":"2026-08-23T12:44:16.683Z","description":"Explains how AWS applications obtain temporary credentials by chaining together Cognito Identity Pool, AWS STS, and IAM roles. Applications first get an OIDC...","image":"https://media.daily.dev/image/upload/s--2-1xRawN--/f_auto/v1722860399/public/Placeholder%2011","thumbnailUrl":"https://media.daily.dev/image/upload/s--2-1xRawN--/f_auto/v1722860399/public/Placeholder%2011","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-aws-iam-role-sts-and-identity-pool-work-together-bjiniv6m8","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"aws,authentication,aws-iam","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"How AWS IAM role, STS and Identity Pool work together"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-aws-iam-role-sts-and-identity-pool-work-together-bjiniv6m8#faq","mainEntity":[{"@type":"Question","name":"How does AWS Cognito Identity Pool get temporary AWS credentials for an authenticated user?","acceptedAnswer":{"@type":"Answer","text":"Cognito Identity Pool calls AssumeRoleWithWebIdentity on AWS STS, passing the OIDC token previously issued by a Cognito User Pool or other identity provider. STS then validates the token and issues temporary AWS credentials that represent the IAM role configured for authenticated users in the Identity Pool settings, along with whatever IAM policy is attached to that role. Piecing together Cognito, STS and IAM roles gets easier with deep dives like this surfaced on daily.dev."}}]} ```