AWS IAM: IAM quota doc: PackedPolicySize deprecated in favor of SessionTokenUtilization
Summary
Two quota bullets (role session policies, role session tags) updated to state that session policies and tags add to the session token size, that SessionTokenUtilization reports usage percentage, and that PackedPolicySize is deprecated; notes that the console can increase session token size.
Security assessment
This is a documentation/API-surface accuracy update about session credential size quotas and a deprecated response element. Session policies and tags relate to least-privilege scoping, but the change only renames the metric used to track size limits and does not describe a vulnerability, credential handling change, or permission boundary.
Evidence
+ * Additionally, session policies and session tags add to the session token size, which has **a separate limit**. The `SessionTokenUtilization` response element shows what percentage of the size limit the token uses. The `PackedPolicySize` response element is deprecated. Use `SessionTokenUtilization` instead.
Diff
diff --git a/IAM/latest/UserGuide/reference_iam-quotas.md b/IAM/latest/UserGuide/reference_iam-quotas.md index 3e476c9a0..daba81c05 100644 --- a//IAM/latest/UserGuide/reference_iam-quotas.md +++ b//IAM/latest/UserGuide/reference_iam-quotas.md @@ -169,2 +169,2 @@ Role [session policies](./access_policies.html#policies_session) | - * Additionally, an AWS conversion compresses the passed session policies and session tags into a packed binary format that has **a separate limit**. The `PackedPolicySize` response element indicates by percentage how close the policies and tags for your request are to the upper size limit. - * We recommend that you pass session policies using the AWS CLI or AWS API. The AWS Management Console might add additional console session information to the packed policy. + * Additionally, session policies and session tags add to the session token size, which has **a separate limit**. The `SessionTokenUtilization` response element shows what percentage of the size limit the token uses. The `PackedPolicySize` response element is deprecated. Use `SessionTokenUtilization` instead. + * We recommend that you pass session policies using the AWS CLI or AWS API. The AWS Management Console might increase the session token size by adding session information. @@ -177 +177 @@ Role [session tags](./id_session-tags.html) | - * An AWS conversion compresses the passed session policies and session tags into a packed binary format that has a separate limit. You can pass session tags using the AWS CLI or AWS API. The `PackedPolicySize` response element indicates by percentage how close the policies and tags for your request are to the upper size limit. + * Session policies and session tags add to the session token size, which has a separate limit. You can pass session tags using the AWS CLI or AWS API. The `SessionTokenUtilization` response element shows what percentage of the size limit the token uses. The `PackedPolicySize` response element is deprecated. Use `SessionTokenUtilization` instead.