Question

A security engineer configures an automation pipeline where an EC2 instance profile role (RoleA) assumes a cross-account role (RoleB) in a partner account to run a long batch job. RoleB has a maximum session duration set to 4 hours. However, when the pipeline calls sts:AssumeRole from RoleA to obtain RoleB credentials, the returned credentials always expire after 1 hour regardless of the DurationSeconds value requested. What is the cause of this behavior?

Accepted Answer

Role chaining limits the assumed-role session to a maximum of 1 hour, and DurationSeconds values above 3600 are rejected or capped.

Answer

The maximum session duration on RoleB must be increased to match the DurationSeconds requested by RoleA.

Answer

STS enforces a hard 1-hour limit on all cross-account AssumeRole calls, so a different mechanism such as SAML federation is required.

Answer

The EC2 instance profile credentials expire after 1 hour, which transitively caps any role assumed from them.