KeyKeeperAWS STS · Temporary credentials
How an agent gets a AWS STS · Temporary credentials key through KeyKeeper, what to choose on aws.amazon.com, and how KeyKeeper verifies it.
| Template id | aws-sts (also aws-temporary) |
|---|---|
| Field | aws-secret-access-key → AWS_SECRET_ACCESS_KEY · secret |
| Also | aws-access-key-id → AWS_ACCESS_KEY_ID · plain, confirmed by you |
| Also | aws-session-token → AWS_SESSION_TOKEN · secret |
| Also | aws-region → AWS_REGION · plain, confirmed by you, optional |
| Also | aws-credential-expires-at → AWS_CREDENTIAL_EXPIRES_AT · plain, confirmed by you |
| Key looks like | whether it can be viewed again is unconfirmed |
| Created at | aws.amazon.com |
| Verified by KeyKeeper | not verified |
| Template checked | 2026-09-15 |
What the agent does
keykeeper providers show aws-sts
keykeeper save --provider aws-sts --from-clipboard --create --purpose "what this task does"
keykeeper run -c aws-sts -- <your command>--provider aws-sts fills in the credential id and the fields. The environment
variables are the ones AWS's own tools read, so nothing has to be mapped.
What only you can do
Use IAM Identity Center or assume a least-privilege role
Obtain one complete STS credential set
Copy all three values and the issued expiration together
Copy the key, then approve the save in KeyKeeper's window.
What to choose
Temporary credentials must include ASIA access-key ID, secret, session token and expiration. Prefer an AWS profile/credential provider chain when the tool supports it.
The agent is told the same thing. It opens the page for you and says what to pick; it never logs in, passes 2FA or pays on your behalf.
What KeyKeeper checks
- Before writing: the value must look like a AWS STS · Temporary credentials key (whether it can be viewed again is unconfirmed). A wrong paste is refused before anything is stored, and the agent is told why — without the value.
- After saving: AWS STS · Temporary credentials offers no read-only endpoint KeyKeeper can use, so the first real call is the test.
Rotation and expiry
STS credentials expire at the provider-issued timestamp; record it on the credential.