AWS IAM: Account access manager session duration documented as 1 hour
Summary
Corrects IAM role session duration for account access manager assignments from up to 12 hours to a default of 1 hour, and replaces the ABAC description with instructions for sending attributes as SAML session tags via the https://aws.amazon.com/SAML/Attributes/AccessControl:TagKey attribute.
Security assessment
Documenting a shorter (1-hour) default session duration for account access manager role sessions reduces credential exposure window, and the updated text documents session-tag/ABAC configuration via SAML attributes, both auth/permission-relevant guidance rather than a vulnerability fix.
Evidence
1. **IAM role session** \- The IAM role a user assumes is a temporary credential for access to AWS resources with a default duration of 1 hour.
Diff
diff --git a/IAM/latest/UserGuide/aam-sessions-access-control.md b/IAM/latest/UserGuide/aam-sessions-access-control.md index af60cc9d5..aa70da263 100644 --- a//IAM/latest/UserGuide/aam-sessions-access-control.md +++ b//IAM/latest/UserGuide/aam-sessions-access-control.md @@ -15 +15 @@ Users who access AWS accounts using assignments in account access manager initia - 1. **IAM role session** \- The IAM role a user assumes is a temporary credential for access to AWS resources that can be active for up to 12 hours. + 1. **IAM role session** \- The IAM role a user assumes is a temporary credential for access to AWS resources with a default duration of 1 hour. @@ -30 +30 @@ For more information about user interactive and application sessions in IAM Iden -IAM role sessions operate independently once established. They persist for the duration configured in the IAM role, which can be up to 12 hours, regardless of the status of the sessions in the account access portal and AWS access portal. This behavior ensures that long-running CLI operations or console sessions are not unexpectedly ended. +Sessions of IAM roles assigned by account access manager operate based on the default session duration of 1 hour, regardless of the maximum session duration set in the IAM role, the status of the sessions in the account access portal and AWS access portal. @@ -38 +38 @@ To revoke user access assumed through account access manager role assignments, s -Account access manager supports attribute-based access control (ABAC) with IAM role tags and user attributes configured as session tags in IAM Identity Center. For more information, see [Attribute-based access control](https://docs.aws.amazon.com/singlesignon/latest/userguide/abac.html) in the _AWS IAM Identity Center User Guide_. +You can configure your identity provider (IdP) to send attributes as session tags through SAML assertions by setting the attribute name to `https://aws.amazon.com/SAML/Attributes/AccessControl:TagKey`, where `TagKey` is the session tag key you want to populate. IAM Identity Center passes the attribute name and value from the IdP through for policy evaluation.