Session Policy
Identity & AccessA Session Policy is an inline IAM policy that you pass when you programmatically create a temporary session (via AssumeRole, AssumeRoleWithSAML, AssumeRoleWithWebIdentity, or GetFederationToken).
How It Works
The effective permissions for the session are the intersection of the role's identity-based policies and the session policy. A session policy cannot grant more permissions than the role already has - it can only further restrict them.
Use Cases
- Per-user scoping: a shared role with different session policies per user, limiting each to their own resources
- Temporary restrictions: grant a break-glass role but scope the session to only the affected resources
- Federation: scope federated user access without creating multiple roles
Limits
- Maximum size: 2048 characters (packed JSON)
- You can pass up to 12 managed policy ARNs as session policies
Related Terms
An AWS identity with temporary credentials that can be assumed by users, services, or applications to perform actions without long-term access keys.
The process of obtaining temporary security credentials by calling AWS STS to take on the permissions of an IAM role.
Short-lived AWS credentials (access key, secret key, session token) issued by STS that expire automatically, eliminating the risk of permanent credential exposure.
A JSON document that defines permissions - which actions are allowed or denied on which AWS resources, and under what conditions.
The security principle of granting only the minimum permissions needed to perform a task - no more, no less.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.