Which service provides the ability to manage temporary security credentials for IAM roles?

The AWS Security Token Service (STS) is specifically designed to handle the provisioning of temporary security credentials for IAM roles. This service allows users to request temporary credentials that can provide access to resources in AWS. It is particularly useful in scenarios where users or applications need to assume IAM roles temporarily without needing to have long-term AWS credentials.

When temporary security credentials are issued through STS, they are typically associated with an IAM role, which defines the permissions that can be accessed. This ensures that users or applications have secure and limited access — ideal for scenarios such as granting access to external users or services, or when implementing best practices for security by reducing the risks associated with long-term credentials.

In comparison, federated access allows users to sign in to AWS using external identity providers but does not specifically manage temporary credentials. Amazon Cognito, while it can manage temporary credentials for mobile and web applications, primarily focuses on user authentication and user directory services. Amazon CloudWatch, on the other hand, is a monitoring and management service designed for cloud resources and applications but does not provide functionalities related to security credentials or IAM roles.