Question

A data engineering team uses an automation pipeline that assumes RoleA in Account 1 via STS. From within that session, the pipeline then assumes RoleB in Account 2 to access data. RoleB has a MaxSessionDuration of 12 hours, and the pipeline requests a 6-hour session when calling AssumeRole for RoleB. The team observes that the credentials for RoleB consistently expire after only 1 hour, causing long-running jobs to fail. What is the cause of this behavior?

Accepted Answer

Role chaining limits the assumed role session to a maximum of 1 hour, regardless of the requested DurationSeconds or the role's MaxSessionDuration.

Answer

The MaxSessionDuration on RoleB must be increased to at least 6 hours, because it currently overrides the requested duration.

Answer

A permissions boundary attached to RoleB is capping the session duration to 1 hour.

Answer

STS temporary credentials always expire after 1 hour and cannot be extended under any circumstances.