STS uses AssumeRole API to generate temporary credentials and login to a different account using the role in that account.