Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Disabling permissions for temporary security credentials

Temporary security credentials are valid until they expire. These credentials are valid for the specified duration, from 900 seconds (15 minutes) up to a maximum of 129,600 seconds (36 hours). The default session duration is 43,200 seconds (12 hours). You can revoke these credentials, but you must also change permissions for the role to stop the use of compromised credentials for malicious account activity. Permissions assigned to temporary security credentials are evaluated each time they are used to make an Amazon request. Once you remove all permissions from the credentials, Amazon requests that use them fail.

It might take a few minutes for policy updates to take effect. Revoke the role’s temporary security credentials to force all users assuming the role to reauthenticate and request new credentials.

You cannot change the permissions for an Amazon Web Services account root user. Likewise, you cannot change the permissions for the temporary security credentials that were created by calling GetFederationToken or GetSessionToken while signed in as the root user. For this reason, we recommend that you do not call GetFederationToken or GetSessionToken as a root user.

Deny access to all sessions associated with a role

Use this approach when you are concerned about suspicious access by:

This procedure denies permissions to all users that have permissions to assume a role.

To change or remove the permissions assigned to the temporary security credentials obtained by calling AssumeRole, AssumeRoleWithSAML, or AssumeRoleWithWebIdentity, GetFederationToken, or GetSessionToken, you can edit or delete the permissions policy that defines the permissions for the role.

When you update the policy, the changes affect the permissions of all temporary security credentials associated with the role, including credentials that were issued before you changed the role's permissions policy. After you update the policy, you can revoke the role’s temporary security credentials to immediately revoke all permissions to the role's issued credentials.

Deny access to a specific session

When you update the roles that are assumable from an IdP with a deny-all policy or delete the role entirely, all users that have access to the role are disrupted. You can deny access based on the Principal element without impacting the permissions of all other sessions associated with the role.

The Principal can be denied permissions using condition context keys or resource-based policies.

Deny a user session with condition context keys

You can use condition context keys in situations where you want to deny access to specific temporary security credential sessions without affecting the permissions of the IAM user or role that created the credentials.

For more information about condition context keys, see Amazon global condition context keys.

After you update the policy, you can revoke the role’s temporary security credentials to immediately revoke all issued credentials.

aws:PrincipalArn

You can use condition context key aws:PrincipalArn to deny access to a specific principal ARN. You do this by specifying the unique identifier (ID) of the IAM user, role, or federated user the temporary security credentials are associated with in the Condition element of a policy.

aws:userid

You can use condition context key aws:userid to deny access to all or specific temporary security credential sessions associated with the IAM user or role. You do this by specifying the unique identifier (ID) of the IAM user, role, or federated user the temporary security credentials are associated with in the Condition element of a policy.

The following policy shows an example of how you can deny access to temporary security credential sessions using condition context key aws:userid.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": "*",
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "aws:userId": [
            "AIDAXUSER1",
            "AROAXROLE1",
            "AROAXROLE2:<caller-specified-role-session-name>",
            "account-id:<federated-user-caller-specified-name>"
          ]
        }
      }
    }
  ]
}

For specific examples of principal key values, see Principal key values. For information about IAM unique identifiers, see Unique identifiers.

Deny a session user with resource-based policies

If the principal ARN is also included in any resource-based policies, you must also revoke access based on the specific user’s principalId or sourceIdentity values in the Principal element of a resource-based policy. If you only update the permissions policy for the role, the user can still perform actions allowed in the resource-based policy.