AWS STS Regions and endpoints

The following table lists the Regions and their endpoints. It indicates which ones are activated by default and which ones you can activate or deactivate.

¹You must enable the Region to use it. This automatically activates AWS STS. You cannot manually activate or deactivate AWS STS in these Regions.

²To use AWS in China, you need an account and credentials specific to AWS in China.

AWS STS global endpoint changes

AWS is making changes to the AWS Security Token Service (AWS STS) global endpoint (https://sts.amazonaws.com) in Regions enabled by default to enhance its resiliency and performance. Previously, all requests to the AWS STS global endpoint were served by a single AWS Region, US East (N. Virginia). Starting in early 2025, requests to the AWS STS global endpoint will automatically be served in the same Region where the request originates, rather than the US East (N. Virginia) Region. These changes will be gradually deployed to all Regions that are enabled by default by mid-2025, starting with the Europe (Stockholm) Region. These changes will not be deployed to opt-in Regions. For more information about which Regions these changes have been deployed to, see AWS STS global endpoint changes deployed Regions.

With these changes, AWS STS will process your request based on the originating Region and DNS resolver used. Requests to the AWS STS global endpoint will be served in the same Region as your AWS deployed workload if the DNS request for the AWS STS global endpoint is handled by the Amazon DNS server in Regions that are enabled by default. However, requests to the AWS STS global endpoint will continue to be served in US East (N. Virginia) Region if your request originated from opt-in Regions or if your request was resolved using a DNS resolver other than the Amazon DNS server. For more information about Amazon DNS, see Amazon DNS server in the Amazon Virtual Private Cloud User Guide.

The following table shows how requests to the AWS STS global endpoint will be routed based on your DNS provider.

To ensure minimal disruption to your existing processes, AWS has implemented the following measures:

If you have workloads in an opt-in Region and are still using the AWS STS global endpoint, we recommend migrating to AWS STS regional endpoints for improved resiliency and performance. For more information about configuring regional AWS STS endpoints, see AWS STS Regional endpoints in the AWS SDKs and Tools Reference Guide.

AWS STS global endpoint changes deployed Regions

The AWS STS global endpoint changes described in the prior section will gradually be rolled out only to Regions enabled by default by mid-2025. These changes have been deployed to the following Regions enabled by default:

AWS CloudTrail and Regional endpoints

Calls to regional and global endpoints are logged in the tlsDetails field in AWS CloudTrail. Calls to regional endpoints, such as us-east-2.amazonaws.com, are logged in CloudTrail to their appropriate region. Calls to the global endpoint, sts.amazonaws.com, are logged as calls to a global service. Events for global AWS STS endpoints are logged to us-east-1.