Secrets & Key Management · Integration
AWS Security Token Service
Add AWS Security Token Service to your product for your customers, and give your AI agents governed access to it.
Embed an AWS Security Token Service integration so your product can obtain short-lived, scoped credentials in each customer's own account rather than holding long-lived keys. Every assume-role call is attributed per tenant and logged, which is what makes cross-account access reviewable after the fact.
In your product
Embedded for your customers. Per-tenant auth, no per-customer code, maintained by fastn.
Assume a role in each customer's account to act with least privilege.
Issue short-lived credentials instead of storing long-lived access keys.
Read the current caller identity so your product can confirm which role it holds.
Scope each session to only the permissions a given operation needs.
For your AI agents
Governed, audited access for the agents you build, through the MCP server.
An agent obtains scoped temporary credentials before touching a customer account.
An agent confirms its effective identity and permissions before acting.
An agent operates under a session whose every call is attributable.
Example prompt
Confirm which role this session is using and what permissions it grants in the customer account.
Set up AWS Security Token Service in 4 steps
- 01Open the AWS Security Token Service connector from your fastn dashboard.
- 02Have each customer create a role for fastn to assume, with least-privilege scopes.
- 03Record the role and external id per customer, then enable the actions you need.
- 04Call them from your product, or expose them to an agent through the MCP server.
Why teams use the AWS Security Token Service integration
What you get by embedding it with fastn instead of building it yourself.
- Ship an AWS Security Token Service integration without building it. Your customers connect their own AWS Security Token Service account inside your product and work their secrets, keys and certificates there, with no per-customer code on your side.
- Handle the part that actually costs time: an expired certificate or an unrotated key is an outage rather than a warning, and it arrives without notice. fastn owns the auth, token refresh, rate limits, pagination and breaking-change fixes, so an AWS Security Token Service update is not your on-call problem.
- One integration serves your product and your agents. The same governed AWS Security Token Service connection powers in-product features and gives AI agents scoped, audited access, so you fetch a credential at the point of use instead of storing it yourself without wiring it twice.
Used by these teams
Compare with
AWS Key Management ServiceWorks well with
OktaOften used alongside
Tools the same teams tend to run next to AWS Security Token Service, across other categories.
ServiceNow
Datadog
PagerDutyAWS Security Token Service integration FAQ
How do I add an AWS Security Token Service integration to my product?
Enable the AWS Security Token Service connector in your fastn dashboard, then let each customer authenticate their own AWS Security Token Service account. fastn handles the OAuth flow, token storage and refresh per tenant, so there is no AWS Security Token Service client code in your app and no per-customer branch in your codebase. Setup is 4 steps.
Do my customers each connect their own AWS Security Token Service account?
Yes. Every connection is scoped to the individual customer, so each authorises their own AWS Security Token Service account and only ever sees their own secrets, keys and certificates. That per-tenant isolation is the point of an embedded integration: you support the long tail of customer setups without maintaining an integration per customer.
Can AI agents use this AWS Security Token Service integration?
Yes. The same connection is exposed to your agents through the fastn MCP gateway, with permissions scoped per tenant and every call audited. An agent obtains scoped temporary credentials before touching a customer account.
Who maintains the AWS Security Token Service integration?
fastn does. When AWS Security Token Service changes an endpoint, deprecates a field or alters its auth, the fix lands in the connector rather than in your backlog, and your customers' connections keep working.
Does my product ever hold the customer's AWS Security Token Service secret?
No longer than the call needs it. Values are fetched under the customer's own credentials at the point of use and never written into your database, and every read is logged per tenant so an access can be traced to what asked for it.
Can rotation and expiry be handled automatically?
Yes, within the permissions the customer grants, and audited. This matters more here than almost anywhere else: an expired certificate or an unrotated key takes something down rather than raising a warning first.
What can I build with the AWS Security Token Service integration?
A common starting point: assume a role in each customer's account to act with least privilege. Teams also use it for the other use cases listed above, and expose it to agents for governed reads and writes.
How much does the AWS Security Token Service integration cost?
It is included. Pricing is based on connected accounts, not on how many connectors you enable, so adding AWS Security Token Service does not change your per-connector cost. You can start free with 3 connected accounts.
Add AWS Security Token Service to your product
Start free with 3 connected accounts. No sales call required, and no per-customer integration code.