code: private SessionCredentialsHolder newSession() {
          AssumeRoleRequest assumeRoleRequest = new AssumeRoleRequest().withRoleArn(roleArn)
                  .withDurationSeconds(roleSessionDurationSeconds)
                  .withRoleSessionName(roleSessionName)
                  .withPolicy(scopeDownPolicy);
          if (roleExternalId != null) {
              assumeRoleRequest = assumeRoleRequest.withExternalId(roleExternalId);
          }
  
          AssumeRoleResult assumeRoleResult = securityTokenService.assumeRole(assumeRoleRequest);
          return new SessionCredentialsHolder(assumeRoleResult.getCredentials());
      }
docs: Starts a new session by sending a request to the AWS Security Token Service (STS) to assume a
  Role using the long lived AWS credentials. This class then vends the short lived session
  credentials for the assumed Role sent back from STS.