AWS IAM: Session tag limit guidance switched to session token size
Summary
Rewrites the failure-condition and limit bullets so that session policies and tags are described as adding to session token size, with errors reporting token size in bytes and guidance to monitor SessionTokenUtilization (PackedPolicySize deprecated).
Security assessment
The edit rewords a size-limit/error-reporting behavior (PackedPolicySize to SessionTokenUtilization) for session tags; it addresses operational limits, not an exploitable weakness or a security control.
Evidence
- * An AWS conversion compresses the passed session policies and session tags combined into a packed binary format with a separate limit. If you exceed this limit, the AWS CLI or AWS API error message shows how close the policies and tags combined come to the upper size limit, by percentage.
Diff
diff --git a/IAM/latest/UserGuide/id_session-tags.md b/IAM/latest/UserGuide/id_session-tags.md index 2f0bf092f..47f0968e3 100644 --- a//IAM/latest/UserGuide/id_session-tags.md +++ b//IAM/latest/UserGuide/id_session-tags.md @@ -74 +74 @@ Operations that support session tagging can fail under the following conditions: - * The total packed size of the combined session policies and tags is too large. If the operation fails, the error message shows how close the policies and tags combined come to the upper size limit, by percentage. + * Session policies and session tags add to the session token size. If the token exceeds the size limit, the operation fails. The error message reports your session token size and the maximum allowed size, both in bytes. Monitor `SessionTokenUtilization` in the AWS STS API response to track your usage. @@ -107 +107 @@ Before you use session tags, review the following details about sessions and tag - * An AWS conversion compresses the passed session policies and session tags combined into a packed binary format with a separate limit. If you exceed this limit, the AWS CLI or AWS API error message shows how close the policies and tags combined come to the upper size limit, by percentage. + * Session policies and session tags add to the session token size. If the token exceeds the size limit, the AWS CLI or AWS API returns an error. The error message reports your session token size and the maximum allowed size, both in bytes. The `SessionTokenUtilization` response element shows what percentage of the size limit the token uses. The `PackedPolicySize` response element is deprecated. Use `SessionTokenUtilization` instead.