AWS STS Simplifies Session Token Size Limits and Adds Monitoring
AWS Security Token Service (STS) now enforces a single 4,096-byte session token limit, replacing previous dual limits that caused ambiguous errors. This provides more capacity for session policies and tags, simplifying infrastructure management. STS also reports token size and utilization via API responses, CloudWatch, and CloudTrail events. A new `MinimumSessionTokenSize` parameter allows engineers to test how their systems handle larger tokens.
- →New parameter for testing maximum token size
- →Single, unified session token size limit
- →Session token size monitoring capabilities
- →Recommended steps for system preparation
Features (1) ›
- New parameter for testing maximum token size
The `MinimumSessionTokenSize` optional parameter has been added to STS session-vending APIs. This allows users to generate session tokens of a specified minimum size (up to 4,096 bytes) to validate how their downstream systems handle larger tokens.
Enhancements (2) ›
- Single, unified session token size limit
AWS STS now enforces a single 4,096-byte limit for the assembled session token, replacing the previous two separate limits for packed policy size and overall token size. This simplifies error handling and provides more predictable behavior for session policies and tags.
- Session token size monitoring capabilities
STS now reports session token size and utilization in successful API responses. This data is also published to Amazon CloudWatch metrics and recorded in AWS CloudTrail events, allowing for better visibility and alarming based on token usage.
Notes (1) ›
- Recommended steps for system preparation
AWS advises validating the maximum session token size supported by your infrastructure using the new `MinimumSessionTokenSize` parameter. It also recommends monitoring token sizes through API responses, CloudWatch, or CloudTrail to proactively manage potential size constraints in client applications.
https://aws.amazon.com/blogs/security/aws-sts-simplifies-session-token-size-limits-and-adds-session-token-size-monitoring/
Related releases
- AWS adds Detected Anomalies widget to Billing and Cost Management Dashboards AWS What's New ·
- AWS Billing Conductor now supports custom rates and usage tier pricing AWS What's New ·
- Connecting SageMaker Unified Studio to Power BI with IAM-Based Domains AWS Big Data Blog ·
- Direct Power BI connectivity to SageMaker Unified Studio via Athena ODBC driver AWS Big Data Blog ·
- AWS details resilient authentication architecture with Cognito Multi-Region Replication AWS Security Blog ·
- Amazon SageMaker Adds Instance Preference Lists for Training and Processing Jobs AWS What's New ·