How to check if an AWS STS access token is valid

Question

I have a lambda function that uses AWS STS to generate temporary credentials and then sends the access token via HTTP to a Web API in an EC2 instance.

Is there a way to validate the received access token from the API?

Answer 1

Calling STS GetCallerIdentity will tell you if the credentials are usable to make API calls, and it will identify the underlying AWS account and assumed role.

For example:

aws sts get-caller-identity
{
    "UserId": "AROAABCDEFGHIJKLMNOPQ:xyz",
    "Account": "123456781234",
    "Arn": "arn:aws:sts::123456781234:assumed-role/somerole"
}

Notes about the response object:

• Account is the AWS account number of the account that owns/contains the calling entity
• UserId is the unique identifier of the calling entity. The exact value depends on the type of entity that is making the call.