AWS IAM medium security documentation change
Summary
Clarified role chaining limitations and EC2 instance profile behavior. Added explicit mention of AWS CLI/API applicability for session duration limits.
Security assessment
The change explicitly documents security controls around role chaining session durations (limited to 1 hour) and clarifies EC2 instance profile exceptions. This addresses potential overprivileged sessions by enforcing stricter session limits in chained role scenarios.
Diff
diff --git a/IAM/latest/UserGuide/id_roles_manage-assume.md b/IAM/latest/UserGuide/id_roles_manage-assume.md index 8ef562394..66b584bfb 100644 --- a//IAM/latest/UserGuide/id_roles_manage-assume.md +++ b//IAM/latest/UserGuide/id_roles_manage-assume.md @@ -19 +19 @@ Method of assuming the role | **Who can assume the role** | **Method to specify -AWS Management Console | User (by [switching roles](./id_roles_use_switch-role-console.html)) | **Maximum session duration** on the **Role** Summary page | 15m | Maximum session duration setting² | 1hr +AWS Management Console | User or roles¹(by [switching roles](./id_roles_use_switch-role-console.html)) | **Maximum session duration** on the **Role** Summary page | 15m | Maximum session duration setting² | 1hr @@ -27 +27 @@ AWS Management Console | User (by [switching roles](./id_roles_use_switch-role-c -¹ Using the credentials for one role to assume a different role is called [role chaining](./id_roles.html#iam-term-role-chaining). When you use role chaining, your new credentials are limited to a maximum duration of one hour. When you use roles to [grant permissions to applications that run on EC2 instances](./id_roles_use_switch-role-ec2.html), those applications are not subject to this limitation. +¹ Using the credentials from one role to assume a different role is called [role chaining](./id_roles.html#iam-term-role-chaining). When you use role chaining, the role's session duration is limited to one hour. This applies to AWS Management Console role switching, AWS CLI, and API operations. This limitation does not apply to the initial assumption of a role from user credentials, or to applications running on Amazon EC2 instances using instance profiles. @@ -35 +35 @@ AWS Management Console | User (by [switching roles](./id_roles_use_switch-role-c - * Amazon EC2 IAM role credentials are not subject to maximum session durations configured in the role. + * Amazon EC2 IAM role credentials are not subject to the maximum session duration configured in the role.