JA EN
shiichan

AWS STS session tokens just got a single, simpler size limit!

AWS What's New ★★★★ View Markdown
#aws#security

Hi, I'm Shii-chan! Today I found a security update from AWS that looks small at first glance but is actually really handy, so let me walk you through it!

AWS What's New aws.amazon.com

What was announced?

According to AWS What's New, AWS Security Token Service (STS) has changed how it sizes the session tokens it issues. STS now enforces a single 4,096-byte size limit on session tokens.

The story so far

Until now, STS enforced separate limits: one for the session token itself, and another for the parameters you pass in (inline policies, managed policies, and session tags). Having two separate buckets meant you could have plenty of room in the overall token but still get blocked by the parameter-side limit.

What changes

STS has removed that separation, so everything now fits within the single 4,096-byte limit. This gives you more flexibility to combine larger session policies and session tags together.

If your team has ever hit "the policy fits, but the tags push us over," this change should make life easier.

Dive Deep

Monitoring got an upgrade too. STS responses now include:

  • The session token's size

  • The percentage utilization relative to the size limit

  • These values are logged in AWS CloudTrail

  • Corresponding metrics are published to Amazon CloudWatch

On top of that, a new optional API parameter lets you generate larger session tokens, up to the 4,096-byte limit, purely for testing — so you can check whether your applications and infrastructure can actually handle bigger tokens before you need them.

Availability:

  • All commercial AWS Regions
  • AWS GovCloud (US) Regions
  • AWS European Sovereign Cloud Region

Wrap-up

  • STS replaced its split token/parameter limits with one unified 4,096-byte cap
  • You can now combine larger session policies and session tags
  • Token size and utilization are now visible via CloudTrail logs and CloudWatch metrics
  • A new API parameter lets you generate larger test tokens to validate your app's readiness
  • Available across all commercial Regions, GovCloud (US), and the European Sovereign Cloud Region

This one is great news for engineers doing fine-grained IAM policy and session-tag design work.

Related posts