Skip to content
FedRAMP Rules Hub
JSON — GET /api/aws-evidence

Keyboard shortcuts

Go

  • Scope — the control cataloggm
  • Plan — your last certification classgp
  • Collect — the recipe indexgc
  • The control you are workinggw
  • Startgh

Move

  • Next rowj
  • Previous rowk
  • Previous in this run[
  • Next in this run]
  • Filter this page's list/
  • Search everything⌘K

Act

  • Copy this page's permalinky
  • Toggle dark moded
  • This sheet?

Rows are whatever the current page lists — controls on Scope, recipes on Plan and Collect.

Control index

The configured ceiling on how long any credential stays valid before its holder must present an authenticator again — MaxSessionDuration on every IAM role, SessionDuration on every IAM Identity Center permission set, and the aws:MultiFactorAuthAge conditions in policy that expire an MFA-backed session independently of the session itself

JSON — GET /api/aws-evidenceMD — /collect/session-lifetime-and-reauthentication.md — this page as markdown, for pasting into an agent

The API supplies the facts, but a human judgement against a documented baseline turns them into evidence.

partial — needs judgementcliquarterlyAWS IAMAWS IAM Identity CenterAWS STS

Fetch

$ aws iam list-roles --query 'Roles[].{Role:RoleName,MaxSessionDuration:MaxSessionDuration}'
$ aws sso-admin list-instances --query 'Instances[].InstanceArn'
$ aws sso-admin list-permission-sets --instance-arn <INSTANCE_ARN>
$ aws sso-admin describe-permission-set --instance-arn <INSTANCE_ARN> --permission-set-arn <PERMISSION_SET_ARN> --query 'PermissionSet.{Name:Name,SessionDuration:SessionDuration}'
$ aws iam get-account-authorization-details --query '{Managed:Policies[].PolicyVersionList[?IsDefaultVersion].Document,UserInline:UserDetailList[].UserPolicyList[].PolicyDocument,RoleInline:RoleDetailList[].RolePolicyList[].PolicyDocument,GroupInline:GroupDetailList[].GroupPolicyList[].PolicyDocument}'

Expected output

Under the projection root roles, one row per IAM role with MaxSessionDuration in SECONDS — the API floor is 3600 and the ceiling 43200, and the value caps what DurationSeconds an AssumeRole call may ask for. Under permission-sets, one row per permission set with SessionDuration as an ISO-8601 duration string (PT1H, PT12H). From get-account-authorization-details, four blocks of policy documents — the default version of every managed policy under Managed, and every INLINE policy under UserInline, RoleInline and GroupInline — each URL-encoded per RFC 3986 and needing a decode before you can search it for aws:MultiFactorAuthAge, a numeric condition key measured in SECONDS since the principal was authorized using MFA. The inline blocks are the reason for the projection: an MFA-age condition written inline on one role is invisible to a query that reads managed policies alone, and reads as an absence rather than as a miss.

Map — what it proves

  • recipe1
Key Security Indicators
KSI-IAM-ELP
NIST 800-53 controls
recipe · 1 recipeIA-11
  • recipe— an authored recipe collects evidence for this control
  • KSI only— a Key Security Indicator reaches it, but no recipe is authored yet
  • orphan— no Key Security Indicator reaches it — a person writes it up instead

What else these families can fetch:IA 6/30 →

GovCloud

IAM, STS and IAM Identity Center are available in both GovCloud (US) Regions; role and permission-set ARNs use partition arn:aws-us-gov, with permission sets taking the form arn:aws-us-gov:sso:::permissionSet/<SSOInstanceID>/<PermissionSetID>. The Identity Center console, SDK and CLI must be reached over FIPS endpoints in GovCloud, and multi-Region Identity Center is not available there, so a single instance holds every permission set in scope.

Notes & assertions

IA-11 asks for re-authentication under organization-defined circumstances. Only one of those circumstances — elapsed time — is in any of these outputs, and even that arrives as a ceiling rather than as an event: MaxSessionDuration caps what a caller may request, it does not report that a session ended or that a human presented an authenticator again. The other circumstances FedRAMP expects an organization to name — a change of role, a change of authenticator, before executing a privileged function, after a defined idle period — have no field here at all. Deciding whether the configured ceilings match the documented circumstances is the human judgement, which is why this is partial and not full. Two scope gaps worth writing into the assessment rather than discovering later. A console session reached through an external identity provider ends on that provider's session policy, and no AWS API reports it: the IdP's own configuration is the artifact. And aws:MultiFactorAuthAge is absent from the request context for federated identities and for requests signed with long-term access keys, so a policy that expires an MFA session governs exactly the principals using temporary MFA-backed credentials and silently governs nobody else — pair it with BoolIfExists on aws:MultiFactorAuthPresent so the not-present case denies rather than passes. A role left at the 3600-second default is not evidence of a decision; a role at 43200 is a decision someone should have written down. Read the distribution, not the extremes. Substitute the instance and permission-set ARNs, which the two list calls supply.

References

This AWS mapping is authored opinion (overlay v3.0.0), versioned separately from the dataset and written against ruleset 2026.07.14.01. The upstream FedRAMP dataset names none of these tools.

The Identity and Access Management run (16)

  • automatable
  • partial — needs judgement
  • narrative — no API proves this

Every authored recipe filed under IAM, in the order the plan works them. The mark says how much of the evidence the command produces on its own.