Account for the one-hour session ceiling when chaining AWS roles

Do not extend a chained session by changing only the target role duration.

Source facts

AWS defines role chaining as using one role to assume another. Chained AWS console, CLI or API role sessions are limited to one hour regardless of the target role’s configured maximum duration. An AssumeRole request using chaining fails if DurationSeconds exceeds that limit.

Source: AWS Documentation.

Applicability

This concerns a second role assumption made with role credentials, rather than every initial federated or user session.

DSE recommendation

DSE recommends drawing the actual credential path used by automation before changing session settings. Identify whether the job starts with a role and then assumes another role, and record the longest required operation. Prefer an approved credential-refresh or direct trust design when a workflow exceeds the chained-session window. Do not introduce long-lived user keys simply to avoid planning renewal. Keep the session source, target role and renewal owner in support notes so expiry failures can be distinguished from permission denials. Specify what happens to partially completed work when renewal is unavailable. Ask the job owner to choose a safe checkpoint or retry boundary and include an expiry-related diagnostic example that omits credentials, making the support procedure useful during a real interruption.

Verification

Proposed verification: reproduce the intended role chain with a test identity, inspect the returned session expiration and compare it with the requested duration. Exercise the application’s approved renewal path and observe behavior near expiry without running destructive workload actions.

Official reference

AWS Documentation. Reviewed October 20, 2026.