AWS IAM medium security documentation change
Summary
Added clarification about SAML metadata validity periods and X.509 certificate expiration handling
Security assessment
The change explicitly warns about IAM not automatically handling X.509 certificate expiration in SAML metadata, which could lead to security risks if certificates expire without proper rotation. This addresses a potential security gap in certificate management.
Diff
diff --git a/IAM/latest/UserGuide/id_roles_providers_create_saml.md b/IAM/latest/UserGuide/id_roles_providers_create_saml.md index 0ce3a81ae..2a8954cf8 100644 --- a//IAM/latest/UserGuide/id_roles_providers_create_saml.md +++ b//IAM/latest/UserGuide/id_roles_providers_create_saml.md @@ -96,0 +97,6 @@ You can use the AWS Management Console to create, update, and delete IAM SAML id +###### Note + +The `validUntil` or `cacheDuration` attribute in your SAML metadata document defines the **Valid until** date for the identity provider. If your SAML metadata document does not include a validity period attribute, the **Valid until** date will not match your X.509 certificate expiration date. + +IAM does not evaluate or take action on the expiration of X.509 certificates in SAML metadata documents. If you are concerned about expired X.509 certificates, we recommend monitoring certificate expiration dates and rotating certificates according to your organization’s governance and security policies. + @@ -99 +105 @@ You can use the AWS Management Console to create, update, and delete IAM SAML id - 7. (Optional) For **Add tags** you can add key–value pairs to help you identify and organize your IdPs. You can also use tags to control access to AWS resources. To learn more about tagging SAML identity providers, see [Tag IAM SAML identity providers](./id_tags_saml.html). + 7. (Optional) For **Add tags** , you can add key–value pairs to help you identify and organize your IdPs. You can also use tags to control access to AWS resources. To learn more about tagging SAML identity providers, see [Tag IAM SAML identity providers](./id_tags_saml.html).