AWS STS simplifies session token size limits and adds session token size monitoring

What it is

AWS STS session token change: a single 4,096-byte limit replaces the old dual packed-policy/token-size limits, with new SessionTokenSize, SessionTokenUtilization, and MinimumSessionTokenSize fields/parameters, as already noted.

How it works

STS serializes and compresses session policies and tags into the token; compression output varies by content, not just character count, so two tag sets with identical length can produce different token sizes. This is why the post says estimating size from input length is unreliable — MinimumSessionTokenSize forces STS to actually assemble a token of a given size for testing, rather than guessing.

Preconditions / Affected

Matters most for systems that store or forward session tokens outside the AWS SDK's control — load balancers, proxies, caches, databases. Example given: a database column defined as varchar(2048) cannot hold a 4,096-byte token. If you only call AWS APIs through an SDK, the SDK handles the token internally and size is not a concern. MinimumSessionTokenSize requires the latest AWS SDK, CLI, or Tools for PowerShell — older versions lack the parameter and must be updated to use it.

What to do

• Test infrastructure limits: call session-vending APIs (AssumeRole, GetSessionToken, etc.) with MinimumSessionTokenSize set to 4096 first, to test against the largest possible token; if a downstream system truncates or rejects it, lower the value to find the actual supported size, then raise that system's limit where possible.
• Monitor ongoing token growth: set CloudWatch alarms in the AWS/STS namespace on SessionTokenSize against the per-system limit found during testing — not against the 4,096-byte maximum, since that's the same for every account and doesn't reflect your own infrastructure's constraint.
• For SDKs that don't yet expose SessionTokenUtilization, use the still-returned PackedPolicySize field, which now reports the same percentage value, to monitor utilization without an SDK upgrade.
• Avoid hard-coding 4,096 as a permanent ceiling in system design — AWS states the limit may rise as new capabilities (added context keys, richer audit metadata, post-quantum signatures) require larger tokens.

Caveats

The post notes PackedPolicySize values may now appear lower than before even when token content hasn't changed, since it's repurposed to track the new unified metric rather than the old packed-policy-only size — worth knowing if you have historical dashboards built on that field.