AWS STS revised its session token size policy by enforcing a unified 4,096-byte limit, replacing previous separate restrictions on tokens and parameters such as policies and tags. This change provides more flexibility for complex session policy and tag combinations. Additionally, STS now returns detailed response fields indicating the token size and percentage of the limit utilized.
The service also logs token size metrics to AWS CloudTrail and publishes them to Amazon CloudWatch, facilitating easier monitoring and troubleshooting. An optional parameter was introduced to generate large tokens up to the limit for testing application readiness. These updates are available across all AWS commercial, GovCloud (US), and European Sovereign Cloud Regions.
Source & further reading
AWS STS simplifies session token size limits and adds session token size monitoring ↗Source published 2026-09-15. This report was prepared with AI assistance from the linked primary-source material. Claims and limitations should be checked against the original announcement or research.