title: How to impersonate individual IAM users with AWS SDK in the Browser
body: <p>I want to create a client-side (server-less) application using the AWS SDK for JavaScript in the Browser. All intended users of the tool have individual IAM users and access to the AWS Web Console. </p>
  
  <p>I want all API calls to be executed in the context of individual IAM users, so they are subject to each user's individual permissions, and so that I can see who did what in CloudTrail.</p>
  
  <p>Since no kind of browser local storage should be trusted with persistent credentials, I cannot simply let the user enter his secret access key once and keep it.</p>
  
  <p>However I guess I could request the user's access key id and secret access key on the beginning of each session, then call STS <code>GetSessionToken</code> with it, and only store the resulting temporary security credentials in the session storage and use that for all following SDK usage.</p>
  
  <p>Of course it would be much nicer for users to be able to log in with their IAM user and password instead of their long and cryptic access key (think of mobile devices...).</p>
  
  <p>Is there any kind of federated login option for IAM users (redirecting them to the AWS IAM login page), or a way to call the STS API with username and password?</p>