# Account for the one-hour session ceiling when chaining AWS roles

> Do not extend a chained session by changing only the target role duration.

- Canonical URL: https://update.dsesecurity.com/updates/account-for-the-one-hour-session-ceiling-when-chaining-aws-roles/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:13:35+00:00
- Modified: 2026-10-20T18:34:29+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

Do not extend a chained session by changing only the target role duration.

## Potentially affected

This concerns a second role assumption made with role credentials, rather than every initial federated or user session.

## DSE recommendation

DSE recommends drawing the actual credential path used by automation before changing session settings.

## Article

Do not extend a chained session by changing only the target role duration.

## Source facts

AWS defines role chaining as using one role to assume another. Chained AWS console, CLI or API role sessions are limited to one hour regardless of the target role’s configured maximum duration. An AssumeRole request using chaining fails if DurationSeconds exceeds that limit.

Source: [AWS Documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html).

## Applicability

This concerns a second role assumption made with role credentials, rather than every initial federated or user session.

## DSE recommendation

DSE recommends drawing the actual credential path used by automation before changing session settings. Identify whether the job starts with a role and then assumes another role, and record the longest required operation. Prefer an approved credential-refresh or direct trust design when a workflow exceeds the chained-session window. Do not introduce long-lived user keys simply to avoid planning renewal. Keep the session source, target role and renewal owner in support notes so expiry failures can be distinguished from permission denials. Specify what happens to partially completed work when renewal is unavailable. Ask the job owner to choose a safe checkpoint or retry boundary and include an expiry-related diagnostic example that omits credentials, making the support procedure useful during a real interruption.

## Verification

Proposed verification: reproduce the intended role chain with a test identity, inspect the returned session expiration and compare it with the requested duration. Exercise the application’s approved renewal path and observe behavior near expiry without running destructive workload actions.

## Official reference

[AWS Documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html). Reviewed October 20, 2026.

## Primary reference

- Name: AWS Documentation
- Authority: docs.aws.amazon.com
- URL: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Account for the one-hour session ceiling when chaining AWS roles,” DSE Security, https://update.dsesecurity.com/updates/account-for-the-one-hour-session-ceiling-when-chaining-aws-roles/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.