How do I test my infrastructure against the AWS STS maximum session token size?

Short description

Session tokens that AWS STS returns can be up to 4,096 bytes. Downstream systems such as HTTP proxies, load balancers, and caches can have size constraints that reject large tokens. Use the MinimumSessionTokenSize parameter to pad tokens to a specified size and test how your infrastructure handles the maximum token size.

Note: The MinimumSessionTokenSize parameter is for testing only. It doesn't grant additional permissions or change the security posture of the token.

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshoot AWS CLI errors. Also, make sure that you're using the most recent AWS CLI version.

Test the maximum token size

The MinimumSessionTokenSize parameter is available on the following AWS STS API operations:

• AssumeRole
• AssumeRoleWithSAML
• AssumeRoleWithWebIdentity
• AssumeRoot
• GetSessionToken
• GetFederationToken

Pass MinimumSessionTokenSize as an integer value between 0 and 4,096 bytes. AWS STS pads the returned session token to at least the specified size. The default value is 0, and no padding is applied.

Use the AWS CLI

To use the AWS to test the maximum token size, run the following assume-role AWS CLI command:

aws sts assume-role \
    --role-arn arn:aws:iam::123456789012:role/DemoRole \
    --role-session-name TokenSizeTest \
    --minimum-session-token-size 4096

Note: Replace arn:aws:iam::123456789012:role/DemoRole with your AWS Identity and Access Management (IAM) role Amazon Resource Name (ARN).

Use the AWS SDK for Python (Boto3)

To use the AWS SDK for Python (Boto3) to test the maximum token size, run the following code:

import boto3

sts = boto3.client("sts")
response = sts.assume_role(
    RoleArn="arn:aws:iam::123456789012:role/DemoRole",
    RoleSessionName="TokenSizeTest",
    MinimumSessionTokenSize=4096
)

Note: Replace arn:aws:iam::123456789012:role/DemoRole with your IAM role ARN.

Verify your infrastructure

To verify your infrastructure against the maximum session token size, complete the following steps:

1. Call the AssumeRole API or another AWS STS API operation in the preceding list with MinimumSessionTokenSize set to 4096.
2. Confirm that AWS STS padded the returned session token to the requested size. Check the API response for SessionTokenSize.
3. Use the returned credentials to exercise the downstream systems that receive session tokens, such as application servers, proxies, caches, and custom middleware.
4. Confirm that each system accepts and processes the token without truncation, errors, or unexpected behavior.
5. If a downstream system fails, then adjust that system's configuration to handle tokens up to 4,096 bytes. Examples of settings to adjust include header buffer sizes, cache entry limits, and database column widths.

Related information

How do I resolve the "PackedPolicyTooLarge" error when I assume an IAM role through AWS STS?

IAM and AWS STS quotas

AWS Security Token Service API Reference