AWS STS Session Token 4096-byte Limit & Monitoring Guide

Vulnerability/Change Overview Core Change: AWS STS has simplified the session token size limit and introduced a new session token size monitoring capability. Specific Changes: - Consolidated the separate "Packed Policy Size" and "Assembled Token Size" limits into a single 4096-byte upper limit. - Added the field to monitor the actual token size. - Added the parameter, allowing users to set a minimum token size (used to test whether the infrastructure supports the 4096-byte limit). Scope of Impact Affected APIs: , , , , , and other APIs that return temporary security credentials. Affected Users: - All users who use STS to obtain temporary credentials. - Systems that depend on session token size (e.g., databases, caches, message queues, etc.). - Operations/security teams that need to monitor token size. Remediation/Mitigation 1. Verify the maximum token size: - Use the parameter to test whether the infrastructure supports the 4096-byte limit. - Example command: - Start testing from 4096 bytes and progressively lower the value to identify the maximum token size supported by the infrastructure. 2. Monitor session token size (Recommended): - Read the and fields in the API response. - Monitor the and metrics in CloudWatch. - Monitor the and fields in CloudTrail. 3. Use the appropriate fields for monitoring: - Use (in bytes) rather than (in percent) for monitoring, as the latter may fluctuate due to changes in the compression algorithm. POC/Exploitation Code API Response Example: CloudTrail Event Record Example: Conclusion Users now have more headroom for session tokens, tags, and session policies. AWS STS enforces the 4096-byte limit and returns a clear error message when the token exceeds the limit. It is recommended to proactively verify token-handling systems, use for testing, and monitor and to maintain continuous visibility.

Goal Reached Thanks to every supporter — we hit 100%!

AWS STS Session Token 4096-byte Limit & Monitoring Guide