The Security Token Service exchanges Google or third-party credentials for a short-lived access token to Google Cloud resources.