AWS IAM: Add session token size/utilization to CloudTrail log examples

Service: IAM · 2026-09-27 · Documentation low

File: IAM/latest/UserGuide/cloudtrail-integration.md · Type: logging

Summary

Adds sessionTokenSize and sessionTokenUtilization fields to multiple example CloudTrail log entries for AssumeRole and identity-provider STS events so the audit examples reflect the new session token metrics.

Security assessment

The change only augments CloudTrail audit log examples with session token size/utilization metrics, which aid monitoring and auditing of temporary credential usage; it documents logging output and does not address a specific vulnerability.

Evidence

        "sessionTokenSize": 1428,

Diff

diff --git a/IAM/latest/UserGuide/cloudtrail-integration.md b/IAM/latest/UserGuide/cloudtrail-integration.md
index c239cc7ed..99e7b522f 100644
--- a//IAM/latest/UserGuide/cloudtrail-integration.md
+++ b//IAM/latest/UserGuide/cloudtrail-integration.md
@@ -224 +224,3 @@ The IAM user named `John` in account 777788889999 calls the AWS STS [AssumeRole]
-      "sourceIdentity": "John"
+        "sourceIdentity": "John",
+        "sessionTokenSize": 1428,
+        "sessionTokenUtilization": 34
@@ -272 +274,3 @@ The second example shows the assumed role account's (111122223333) CloudTrail lo
-      "sourceIdentity": "John"
+        "sourceIdentity": "John",
+        "sessionTokenSize": 1428,
+        "sessionTokenUtilization": 34
@@ -346 +350,3 @@ The following example shows a CloudTrail log entry for a request made by John Do
-        "sourceIdentity": "John"
+            "sourceIdentity": "John",
+            "sessionTokenSize": 1652,
+            "sessionTokenUtilization": 40
@@ -451 +457,3 @@ The following example shows a CloudTrail log entry for a request made for the AW
-            "packedPolicySize": 1,
+            "packedPolicySize": 34,
+            "sessionTokenSize": 1428,
+            "sessionTokenUtilization": 34,
@@ -533 +541,3 @@ The CloudTrail log entry also contains an `additionalEventData` field with an `i
-        "audience": "<id of application>"
+        "audience": "<id of application>",
+        "sessionTokenSize": 1536,
+        "sessionTokenUtilization": 37
@@ -613 +623,3 @@ The following example shows a CloudTrail log entry for an AWS STS request made t
-            }
+            },
+            "sessionTokenSize": 1096,
+            "sessionTokenUtilization": 26
@@ -687 +699,3 @@ For comparison, the following example shows a CloudTrail log entry for an AWS ST
-            }
+            },
+            "sessionTokenSize": 1096,
+            "sessionTokenUtilization": 26