private void startSession() {
        AssumeRoleWithWebIdentityResult sessionTokenResult = securityTokenService
                .assumeRoleWithWebIdentity(new AssumeRoleWithWebIdentityRequest().withWebIdentityToken(wifToken)
                        .withProviderId(wifProvider)
                        .withRoleArn(roleArn)
                        .withRoleSessionName("ProviderSession")
                        .withDurationSeconds(this.sessionDuration));

        String accountId = StsAuthUtils.accountIdFromArn(sessionTokenResult.getAssumedRoleUser());

        Credentials stsCredentials = sessionTokenResult.getCredentials();

        subjectFromWIF = sessionTokenResult.getSubjectFromWebIdentityToken();

        sessionCredentials = new BasicSessionCredentials(
                stsCredentials.getAccessKeyId(),
                stsCredentials.getSecretAccessKey(),
                stsCredentials.getSessionToken(),
                accountId,
                PROVIDER_NAME);
        sessionCredentialsExpiration = stsCredentials.getExpiration();
    }
Starts a new session by sending a request to the AWS Security Token
Service (STS) with the long lived AWS credentials. This class then vends
the short lived session credentials sent back from STS.
aws-java-sdk-sts/src/main/java/com/amazonaws/auth/WebIdentityFederationSessionCredentialsProvider.java