AWS STS get-federation-token과 get-session-token 차이

get-federation-token

$ aws sts get-federation-token --name test
{
    "Credentials": {
        "AccessKeyId": "ASIAU2YLFTR7ALYQWKL2",
        "SecretAccessKey": "pffWqq0UIbukJ0foBYxQ1Q+WpCfIapojN1MvCLgE",
        "SessionToken": "IQoJb3JpZ2luX2VjEAMaDmFwLW5vcnRoZWFzdC0yIkcwRQIhAJuho9YXm0q9eLX2ju7ZVX7TXnOdMIJvks96fZIFeLhMAiAJAgcuyE43fBS8wCronDADWzpiAVIsQ0xbeiVT9szwcCqDAgiN//////////8BEAEaDDMzMjM0NjUzMDk0MiIMrkO+6hagUL01xvnWKtcBnndwSwZdekAIfUju4kQnEJmTitxhqzJM+vAMMzl2ApJOLqDcuB7NlwEu0fvlWeb94AAC7OwS5YCR+3Pgfx30zgGVPnUhCfWubi8+6qIOu2DEgUXA0JJ7UDNmeCtCrfCVH/YiBTZGEKO2ceUgkKERdSs7DWh2KXApTejN+d5xwqVOujEgP3x6SpnY+KgXjLoGrhjTzjPEfr5eawB7eTYdat4x3YmgI7eC+T0T2xUnmMKKIVvUk4uHQlqbHQsx4GbGoztQMc8xJr7/bRVdJcpxJAUpTun0jjYw0K/khAY6mQFWR3UxiQ2TnWtFVFL8C74aJLJwI95d5NlDk4TweK8K7yIvS747OoqMBkdwZcuRouo/OA3eNv8Xe/tcRmcpHZ4h3atLCB5UIaY9vwPYiIw+U90smzT0K2bCXiMX9w6HoujFKs2dGD9FWDZsCZ89VspwkFKpuR/ID1w0zGbY4BM2epY7B1psEMiO+wfEHIxPQCFK/CordmLmT9g=",
        "Expiration": "2021-05-10T23:24:00+00:00"
    },
    "FederatedUser": {
        "FederatedUserId": "332346530942:test",
        "Arn": "arn:aws:sts::332346530942:federated-user/test"
    },
    "PackedPolicySize": 0
}

test 라는 이름의 federated-user를 새로 하나 만든다. 이거 자체로는 아무런 Role도 갖고 있지 않아서 Role을 붙여 주기 전에 해당 federated-user가 할 수 있는 것은 아무 것도 없다. federated-user가 Assume 할 수 있는 Role을 만들어 줘야 한다.

get-session-token

$ aws sts get-session-token
{
    "Credentials": {
        "AccessKeyId": "ATIAU2YLF6R7BVTAAIPY",
        "SecretAccessKey": "NCxCFySqtXe6D2aDHJlnHR+mW+p3zzUw6mPw5Xqd",
        "SessionToken": "IQoJb33pZ2luX2VjEAMaDmFwLW5vcnRoZWFzdC0yIkcwRQIgODT5lCT8wxQLmACatfFmcYcTXl81RFZbYXAX0NGKpGICIQDapfjQ+fWTjnHZFp/Tvl8IYv4G48HfONEt+Xm+FFuGRCr0AQiN//////////8BEAEaDDMzMjM0NjUzMDk0MiIMotbBDG4FCC9tcW1RKsgBSlvXI3ugmM9PwevgSxKwxb6VpM/s6BC4TGzqWh4dtVQrfj9biELoEMRBLJOAxVzxBcFdlRBMC6my7RpJOAlIulZTJiqNZGI90y1mfjXtgXmK6S4pQIYonek/R2HVvRf6jrnK7/amCbbedSzBG+bmrUF0mSBlJQqNl6x+21SZRGq5gE0mcQXJZOZ54jgEMEVnbXkoXMqJeTuR6kR/P81aoFIvssHD+xsoDyS0zx6Rq5USN54/ytGB6NRdSHV7MbGeuaAcgbRT6Ecw7rDkhAY6mAF6n40GnBbVlO3e+hKIbCCXp2w1NdMPaJHRcPDPuHpeXJC/9byJ+ydalI1y/wfUgNM9ZAsuIxY3w0VRzevNndzN7aUyJXF26TwoaXe8BH6xTijpbQkmE1TDm68g2RHW0QYH6bwRmVeM49V9a986O0jJKTsBHjrdQkFwk5hSJnnWjrrKb6RtFbOhdg8jih0784Eex1GGv+AxGA==",
        "Expiration": "2021-05-10T23:26:38+00:00"
    }
}

해당 명령을 실행하는 Credential의 복사본을 생성한다. 이 복사본은 Expiration이 존재 한다.
MFA 강제 하는 IAM Role이 걸려 있는 경우, Programmatic access를 위해 반드시 get-session-token 수행을 통하여 접근해야 한다.