IAM users do not have permission to create Temporary Security Credentials for federated users
and roles by default. In contrast, IAM users can call ______ without the need of any special
permissions

A.
GetSessionName

B.
GetFederationToken

C.
GetSessionToken

D.
GetFederationName

Explanation:
Currently the STS API command GetSessionToken is available to every IAM user in your account
without previous permission. In contrast, the GetFederationToken command is restricted and
explicit permissions need to be granted so a user can issue calls to this particular Action

http://docs.aws.amazon.com/STS/latest/UsingSTS/STSPermission.html