AWS adds temporary credential exchange across cloud partitions

AWS says its Security Token Service now lets workloads exchange their identity in one AWS partition for temporary credentials in another, removing the need to store long-term credentials for that access. Partitions group AWS Regions and maintain independent identity systems. Workloads request a short-lived token locally and exchange it for credentials in the destination partition. Organizations can restrict role access and audit token use through CloudTrail in both partitions. The feature carries no additional charge and is available across commercial, GovCloud, China and European Sovereign Cloud regions. Organizations with public key infrastructure can alternatively use IAM Roles Anywhere.