● Covered by 1 source · 1 reportMedium impact1 neutral
AWS STS simplifies session token size limits to 4,096 bytes and adds monitoring
Key points
- AWS STS now uses a single 4,096-byte session token size limit.
- Previous separate packed policy and overall token limits are removed.
- Session token size is reported in API responses, CloudWatch, and CloudTrail.
- Existing error handling for PackedPolicyTooLargeException remains compatible.
Simplified Session Token Limits
AWS Security Token Service (STS) has consolidated its session token size limits. Previously, STS enforced two distinct limits: one for the packed policy and another for the overall session token. These have been replaced by a single, unified limit of 4,096 bytes for the assembled session token. This change provides more capacity for session policies and tags within the token.
Enhanced Monitoring Capabilities
STS now includes session token size information in various outputs. Successful API responses from STS session-vending APIs, such as AssumeRole and GetSessionToken, now report SessionTokenSize in bytes and SessionTokenUtilization as a percentage of the 4,096-byte limit. This data is also available in Amazon CloudWatch metrics and AWS CloudTrail events, enabling better monitoring and management of token sizes.
Impact on Error Handling
The change in limits means that a request will now fail if the assembled session token exceeds 4,096 bytes. STS will continue to return the PackedPolicyTooLargeException in such cases. This ensures that existing error-handling code remains compatible without requiring updates to SDKs or applications.
Future Flexibility
While the current maximum is 4,096 bytes, AWS has indicated that this is not a permanent ceiling. The limit may be increased in the future as new capabilities are introduced that require session tokens to carry more information. Users can also generate session tokens of varying sizes to determine the maximum size supported by their infrastructure.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
AWS Security Token Service (STS) has replaced its two session token size limits with a single 4,096-byte limit, providing more space for session policies and tags. STS now reports session token size in API responses, CloudWatch metrics, and CloudTrail events, allowing users to monitor and optimize token usage.