{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/account-for-the-one-hour-session-ceiling-when-chaining-aws-roles/", "item": { "id": "https://update.dsesecurity.com/updates/account-for-the-one-hour-session-ceiling-when-chaining-aws-roles/", "slug": "account-for-the-one-hour-session-ceiling-when-chaining-aws-roles", "url": "https://update.dsesecurity.com/updates/account-for-the-one-hour-session-ceiling-when-chaining-aws-roles/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/account-for-the-one-hour-session-ceiling-when-chaining-aws-roles.md", "json": "https://update.dsesecurity.com/api/v1/posts/account-for-the-one-hour-session-ceiling-when-chaining-aws-roles/" }, "title": "Account for the one-hour session ceiling when chaining AWS roles", "summary": "Do not extend a chained session by changing only the target role duration.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:13:35+00:00", "modified_at": "2026-10-20T18:34:29+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 249, "potentially_affected": "This concerns a second role assumption made with role credentials, rather than every initial federated or user session.", "dse_recommendation": "DSE recommends drawing the actual credential path used by automation before changing session settings.", "primary_source": { "name": "AWS Documentation", "url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html", "published_on": null, "authority": "docs.aws.amazon.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Do not extend a chained session by changing only the target role duration.

\n

Source facts

\n

AWS defines role chaining as using one role to assume another. Chained AWS console, CLI or API role sessions are limited to one hour regardless of the target role’s configured maximum duration. An AssumeRole request using chaining fails if DurationSeconds exceeds that limit.

\n

Source: AWS Documentation.

\n

Applicability

\n

This concerns a second role assumption made with role credentials, rather than every initial federated or user session.

\n

DSE recommendation

\n

DSE recommends drawing the actual credential path used by automation before changing session settings. Identify whether the job starts with a role and then assumes another role, and record the longest required operation. Prefer an approved credential-refresh or direct trust design when a workflow exceeds the chained-session window. Do not introduce long-lived user keys simply to avoid planning renewal. Keep the session source, target role and renewal owner in support notes so expiry failures can be distinguished from permission denials. Specify what happens to partially completed work when renewal is unavailable. Ask the job owner to choose a safe checkpoint or retry boundary and include an expiry-related diagnostic example that omits credentials, making the support procedure useful during a real interruption.

\n

Verification

\n

Proposed verification: reproduce the intended role chain with a test identity, inspect the returned session expiration and compare it with the requested duration. Exercise the application’s approved renewal path and observe behavior near expiry without running destructive workload actions.

\n

Official reference

\n

AWS Documentation. Reviewed October 20, 2026.

", "content_text": "Do not extend a chained session by changing only the target role duration.\nSource facts\nAWS defines role chaining as using one role to assume another. Chained AWS console, CLI or API role sessions are limited to one hour regardless of the target role’s configured maximum duration. An AssumeRole request using chaining fails if DurationSeconds exceeds that limit.\nSource: AWS Documentation.\nApplicability\nThis concerns a second role assumption made with role credentials, rather than every initial federated or user session.\nDSE recommendation\nDSE recommends drawing the actual credential path used by automation before changing session settings. Identify whether the job starts with a role and then assumes another role, and record the longest required operation. Prefer an approved credential-refresh or direct trust design when a workflow exceeds the chained-session window. Do not introduce long-lived user keys simply to avoid planning renewal. Keep the session source, target role and renewal owner in support notes so expiry failures can be distinguished from permission denials. Specify what happens to partially completed work when renewal is unavailable. Ask the job owner to choose a safe checkpoint or retry boundary and include an expiry-related diagnostic example that omits credentials, making the support procedure useful during a real interruption.\nVerification\nProposed verification: reproduce the intended role chain with a test identity, inspect the returned session expiration and compare it with the requested duration. Exercise the application’s approved renewal path and observe behavior near expiry without running destructive workload actions.\nOfficial reference\nAWS Documentation. Reviewed October 20, 2026.", "content_markdown": "Do not extend a chained session by changing only the target role duration.\n\n## Source facts\n\nAWS defines role chaining as using one role to assume another. Chained AWS console, CLI or API role sessions are limited to one hour regardless of the target role’s configured maximum duration. An AssumeRole request using chaining fails if DurationSeconds exceeds that limit.\n\nSource: [AWS Documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html).\n\n## Applicability\n\nThis concerns a second role assumption made with role credentials, rather than every initial federated or user session.\n\n## DSE recommendation\n\nDSE recommends drawing the actual credential path used by automation before changing session settings. Identify whether the job starts with a role and then assumes another role, and record the longest required operation. Prefer an approved credential-refresh or direct trust design when a workflow exceeds the chained-session window. Do not introduce long-lived user keys simply to avoid planning renewal. Keep the session source, target role and renewal owner in support notes so expiry failures can be distinguished from permission denials. Specify what happens to partially completed work when renewal is unavailable. Ask the job owner to choose a safe checkpoint or retry boundary and include an expiry-related diagnostic example that omits credentials, making the support procedure useful during a real interruption.\n\n## Verification\n\nProposed verification: reproduce the intended role chain with a test identity, inspect the returned session expiration and compare it with the requested duration. Exercise the application’s approved renewal path and observe behavior near expiry without running destructive workload actions.\n\n## Official reference\n\n[AWS Documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/account-for-the-one-hour-session-ceiling-when-chaining-aws-roles/", "url": "https://update.dsesecurity.com/updates/account-for-the-one-hour-session-ceiling-when-chaining-aws-roles/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/account-for-the-one-hour-session-ceiling-when-chaining-aws-roles/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Account for the one-hour session ceiling when chaining AWS roles", "item": "https://update.dsesecurity.com/updates/account-for-the-one-hour-session-ceiling-when-chaining-aws-roles/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/account-for-the-one-hour-session-ceiling-when-chaining-aws-roles/#article", "identifier": "https://update.dsesecurity.com/updates/account-for-the-one-hour-session-ceiling-when-chaining-aws-roles/", "url": "https://update.dsesecurity.com/updates/account-for-the-one-hour-session-ceiling-when-chaining-aws-roles/", "headline": "Account for the one-hour session ceiling when chaining AWS roles", "description": "Do not extend a chained session by changing only the target role duration.", "abstract": "Do not extend a chained session by changing only the target role duration.", "articleBody": "Do not extend a chained session by changing only the target role duration.\nSource facts\nAWS defines role chaining as using one role to assume another. Chained AWS console, CLI or API role sessions are limited to one hour regardless of the target role’s configured maximum duration. An AssumeRole request using chaining fails if DurationSeconds exceeds that limit.\nSource: AWS Documentation.\nApplicability\nThis concerns a second role assumption made with role credentials, rather than every initial federated or user session.\nDSE recommendation\nDSE recommends drawing the actual credential path used by automation before changing session settings. Identify whether the job starts with a role and then assumes another role, and record the longest required operation. Prefer an approved credential-refresh or direct trust design when a workflow exceeds the chained-session window. Do not introduce long-lived user keys simply to avoid planning renewal. Keep the session source, target role and renewal owner in support notes so expiry failures can be distinguished from permission denials. Specify what happens to partially completed work when renewal is unavailable. Ask the job owner to choose a safe checkpoint or retry boundary and include an expiry-related diagnostic example that omits credentials, making the support procedure useful during a real interruption.\nVerification\nProposed verification: reproduce the intended role chain with a test identity, inspect the returned session expiration and compare it with the requested duration. Exercise the application’s approved renewal path and observe behavior near expiry without running destructive workload actions.\nOfficial reference\nAWS Documentation. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:13:35+00:00", "dateModified": "2026-10-20T18:34:29+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/account-for-the-one-hour-session-ceiling-when-chaining-aws-roles/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/account-for-the-one-hour-session-ceiling-when-chaining-aws-roles/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Account for the one-hour session ceiling when chaining AWS roles" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 249, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "AWS Documentation", "url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html" } } ] } }