AWS IAM: STS response docs: SessionTokenSize/Utilization replace PackedPolicySize
Summary
Updates the STS temporary-credential response examples to include SessionTokenSize and SessionTokenUtilization, and rewrites the limit explanation to say session policies and tags add to session token size, noting PackedPolicySize is deprecated.
Security assessment
The change is a response-field/limit documentation update for AssumeRole-style APIs; it clarifies how session token size limits are reported but does not describe a vulnerability, credential-handling rule, or new protection.
Evidence
+ <SessionTokenSize>1428</SessionTokenSize>
Diff
diff --git a/IAM/latest/UserGuide/id_credentials_temp_request.md b/IAM/latest/UserGuide/id_credentials_temp_request.md index bf21effb5..3d7a64c9c 100644 --- a//IAM/latest/UserGuide/id_credentials_temp_request.md +++ b//IAM/latest/UserGuide/id_credentials_temp_request.md @@ -104 +104,3 @@ In addition to the temporary security credentials, the response includes the Ama - <PackedPolicySize>8</PackedPolicySize> + <PackedPolicySize>34</PackedPolicySize> + <SessionTokenSize>1428</SessionTokenSize> + <SessionTokenUtilization>34</SessionTokenUtilization> @@ -113 +115 @@ In addition to the temporary security credentials, the response includes the Ama -An AWS conversion compresses the passed session policies and session tags into a packed binary format that has a separate limit. Your request can fail for this limit even if your plaintext meets the other requirements. The `PackedPolicySize` response element indicates by percentage how close the policies and tags for your request are to the upper size limit. +Session policies and session tags add to the session token size. If the token exceeds the size limit, your request fails, even if your plaintext is within the other limits. The `SessionTokenUtilization` response element shows what percentage of the size limit the token uses. The `PackedPolicySize` response element is deprecated. Use `SessionTokenUtilization` instead. @@ -238 +240,3 @@ In addition to the temporary security credentials, the response includes the Ama - <PackedPolicySize>4</PackedPolicySize> + <PackedPolicySize>26</PackedPolicySize> + <SessionTokenSize>1105</SessionTokenSize> + <SessionTokenUtilization>26</SessionTokenUtilization> @@ -247 +251 @@ In addition to the temporary security credentials, the response includes the Ama -An AWS conversion compresses the passed session policies and session tags into a packed binary format that has a separate limit. Your request can fail for this limit even if your plaintext meets the other requirements. The `PackedPolicySize` response element indicates by percentage how close the policies and tags for your request are to the upper size limit. +Session policies and session tags add to the session token size. If the token exceeds the size limit, your request fails, even if your plaintext is within the other limits. The `SessionTokenUtilization` response element shows what percentage of the size limit the token uses. The `PackedPolicySize` response element is deprecated. Use `SessionTokenUtilization` instead. @@ -298,0 +303,2 @@ The `AUTHPARAMS` parameter in the example is a placeholder for your _signature_. + <SessionTokenSize>856</SessionTokenSize> + <SessionTokenUtilization>20</SessionTokenUtilization>