🚀 Stop Calling STS on Every Request: Redis Caching Patterns That Cut Login Latency by 10x

How caching sessions and temporary AWS credentials in Redis turned our auth layer from a bottleneck into a near-zero-cost lookup The Moment We Realized Our Auth Was a DDoS on Ourselves Every authenticated request in our multi-tenant platform did the same dance: Validate the user's session Check their role mappings (tenant, use case, environment) Call AWS STS to assume the right IAM role Return temporary credentials so downstream services could talk to S3, DynamoDB, Bedrock, etc. Steps 1–3 hit the network. Every. Single. Time. At modest traffic, it was fine. At scale, we were essentially DDoS-ing our own identity layer—STS throttling kicked in, latency spiked, and users saw login spinners that never stopped spinning. The fix wasn't a new auth framework. It was Redis . TL;DR (If You Skim, Skim This) Problem: Per-request STS calls + stateless session validation = slow logins + rate limiting at scale. Move: Cache session data and STS credentials in Redis with structured keys and smart TTLs