AWS IAM high security documentation change
Summary
Clarified that IAM sets the 'Valid until' date independently of SAML metadata attributes and updated explanation of certificate expiration handling during authentication
Security assessment
The change corrects critical misunderstandings about security controls: IAM does not rely on metadata expiration attributes or certificate validity for authentication decisions, which could lead to misconfigured security policies. It explicitly states that authentication validity is enforced via SAML assertion attributes (NotOnOrAfter), directly addressing potential security misconfigurations.
Diff
diff --git a/IAM/latest/UserGuide/id_roles_providers_create_saml.md b/IAM/latest/UserGuide/id_roles_providers_create_saml.md index dcee05d91..3d356545f 100644 --- a//IAM/latest/UserGuide/id_roles_providers_create_saml.md +++ b//IAM/latest/UserGuide/id_roles_providers_create_saml.md @@ -101 +101 @@ You can use the AWS Management Console to create, update, and delete IAM SAML id -The `validUntil` or `cacheDuration` attribute in your SAML metadata document defines the **Valid until** date for the identity provider. If your SAML metadata document does not include a validity period attribute, the **Valid until** date will not match your X.509 certificate expiration date. +The **Valid until** date displayed for the identity provider is set by IAM at provider creation time. It does not reflect the `validUntil` or `cacheDuration` attributes in your SAML metadata document. IAM does not use these metadata attributes to determine the **Valid until** date. @@ -103 +103 @@ The `validUntil` or `cacheDuration` attribute in your SAML metadata document def -IAM does not evaluate or take action on the expiration of X.509 certificates in SAML metadata documents. If you are concerned about expired X.509 certificates, we recommend monitoring certificate expiration dates and rotating certificates according to your organization’s governance and security policies. +IAM does not evaluate or take action on the expiration of the SAML metadata document or X.509 certificates in SAML metadata documents during SAML authentication. SAML authentication validity is enforced at the assertion level, using the `NotOnOrAfter` attribute in the assertion’s `Conditions` and `SubjectConfirmationData` elements. If you are concerned about expired X.509 certificates, we recommend monitoring certificate expiration dates and rotating certificates according to your organization’s governance and security policies.