Loading story…
AWS Security Token Service (STS) has replaced separate packed-policy and assembled-token constraints with a single 4,096-byte assembled session-token limit. STS temporary-credential APIs now report token size and percentage utilization, giving organizations visibility into growth caused by session policies, session tags, and other credential attributes.
AWS has also added an optional MinimumSessionTokenSize parameter, allowing customers to test whether applications and infrastructure can safely store, transmit, and process larger temporary credentials. Organizations should identify limits in proxies, caches, load balancers, headers, databases, and other intermediaries; monitor the new CloudTrail fields and CloudWatch metrics; and avoid hard-coding the current maximum because AWS may increase it.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
AWS Security Token Service replaced separate packed-policy and assembled-token limits with a single 4,096-byte assembled session-token limit. STS added token-size and utilization fields to API responses and CloudTrail, CloudWatch metrics, and the optional MinimumSessionTokenSize parameter for infrastructure compatibility testing.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
aws.amazon.com
Open sourcedocs.aws.amazon.com
Open sourcedocs.aws.amazon.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Elastic Security Labs detailed how AWS Security Token Service (STS) `AssumeRoot` can be abused when an IAM principal has overly broad permissions in an AWS Organization. The API issues temporary, task-policy-scoped credentials for the root user of a member account; in the demonstrated white-box scenario, an attacker used the `IAMCreateRootUserPassword` task policy to create a root login profile and prepare persistent console access. Completing the takeover would also require access to the member account’s root-email inbox to reset or establish the root password. Elastic reported no publicly known in-the-wild abuse at the time of publication. Organizations should restrict `AssumeRoot` permissions and approved task policies to narrowly defined administrative roles, review delegation across member accounts, and enforce MFA and root-account credential guardrails. Security teams should retain organization-wide CloudTrail visibility and alert on unusual or rare `AssumeRoot` calls, especially when followed by root `CreateLoginProfile` activity, as these events may indicate an attempt to establish root-level persistence in a member account.
Aug 26, 2026
CISA and NIST released **NIST IR 8587**, *Protecting Tokens and Assertions from Forgery, Theft, and Misuse*, with implementation recommendations for federal agencies and cloud service providers using tokens in single sign-on, identity federation, API access, and workload-identity environments. Developed through CISA’s Joint Cyber Defense Collaborative in support of Executive Order 14306, the final report addresses attacks involving token forgery, theft, replay, weak validation, compromised signing keys, and misuse—risks that can allow attackers to bypass multifactor authentication. The guidance calls for protected signing-key management, rigorous token verification, short validity periods, credential scoping, revocation and replay controls, sender-constrained tokens, and continuous monitoring. It also covers token exposure in CI/CD pipelines, machine-to-machine and agentic-AI use cases, and preparation of public-key infrastructure for post-quantum cryptographic migration; the final version incorporates feedback from nearly 250 public comments and more than 20 contributors.
Sep 15, 2026
AWS guidance highlights **Resource Control Policies (RCPs)** as organization-level guardrails that constrain resource policies, including access granted to principals outside an AWS Organization. RCPs complement Service Control Policies by applying to external principals, helping prevent attacker-controlled accounts from bypassing internal SCP restrictions. They can enforce data-perimeter standards for cross-account access, IAM role assumption, OIDC federation, and transport security, alongside controls such as VPC Block Public Access and centrally managed root access. For Amazon S3, AWS supports bucket and access-point policies using `s3:TlsVersion` and `aws:SecureTransport` to require stronger encryption in transit, including TLS 1.3 where needed; AWS service API endpoints require TLS 1.2 or later by default. Organizations should use IAM Access Analyzer and access logs to identify dependencies, test RCPs in sandbox accounts, and roll them out progressively because RCPs lack an audit-only mode and can generate generic `AccessDenied` errors. Legacy TLS clients can be isolated behind CloudFront, while S3 Access Points allow stricter TLS requirements for selected access paths to the same data.
Sep 3, 2026