# The configured ceiling on how long any credential stays valid before its holder must present an authenticator again — MaxSessionDuration on every IAM role, SessionDuration on every IAM Identity Center permission set, and the aws:MultiFactorAuthAge conditions in policy that expire an MFA-backed session independently of the session itself

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /collect/session-lifetime-and-reauthentication

Recipe id: `session-lifetime-and-reauthentication` · cadence quarterly · partial

> **Authored opinion.** AWS overlay v3.0.0, written
> against dataset 2026.07.14.01. The upstream
> FedRAMP rules name none of these tools; this mapping is ours.

## What it proves

- KSI `KSI-IAM-ELP`
- control `ia-11`

## Collection

Kind: `cli`

```sh
# list-roles
aws iam list-roles --query 'Roles[].{Role:RoleName,MaxSessionDuration:MaxSessionDuration}'
# list-instances
aws sso-admin list-instances --query 'Instances[].InstanceArn'
# list-permission-sets
aws sso-admin list-permission-sets --instance-arn <INSTANCE_ARN>
# describe-permission-set
aws sso-admin describe-permission-set --instance-arn <INSTANCE_ARN> --permission-set-arn <PERMISSION_SET_ARN> --query 'PermissionSet.{Name:Name,SessionDuration:SessionDuration}'
# get-account-authorization-details
aws iam get-account-authorization-details --query '{Managed:Policies[].PolicyVersionList[?IsDefaultVersion].Document,UserInline:UserDetailList[].UserPolicyList[].PolicyDocument,RoleInline:RoleDetailList[].RolePolicyList[].PolicyDocument,GroupInline:GroupDetailList[].GroupPolicyList[].PolicyDocument}'
```

## Expected output

Under the projection root roles, one row per IAM role with MaxSessionDuration in SECONDS — the API floor is 3600 and the ceiling 43200, and the value caps what DurationSeconds an AssumeRole call may ask for. Under permission-sets, one row per permission set with SessionDuration as an ISO-8601 duration string (PT1H, PT12H). From get-account-authorization-details, four blocks of policy documents — the default version of every managed policy under Managed, and every INLINE policy under UserInline, RoleInline and GroupInline — each URL-encoded per RFC 3986 and needing a decode before you can search it for aws:MultiFactorAuthAge, a numeric condition key measured in SECONDS since the principal was authorized using MFA. The inline blocks are the reason for the projection: an MFA-age condition written inline on one role is invisible to a query that reads managed policies alone, and reads as an absence rather than as a miss.

## Assertions

_No machine-checkable assertion is authored for this recipe._

## GovCloud

IAM, STS and IAM Identity Center are available in both GovCloud (US) Regions; role and permission-set ARNs use partition arn:aws-us-gov, with permission sets taking the form arn:aws-us-gov:sso:::permissionSet/<SSOInstanceID>/<PermissionSetID>. The Identity Center console, SDK and CLI must be reached over FIPS endpoints in GovCloud, and multi-Region Identity Center is not available there, so a single instance holds every permission set in scope.

## Notes

IA-11 asks for re-authentication under organization-defined circumstances. Only one of those circumstances — elapsed time — is in any of these outputs, and even that arrives as a ceiling rather than as an event: MaxSessionDuration caps what a caller may request, it does not report that a session ended or that a human presented an authenticator again. The other circumstances FedRAMP expects an organization to name — a change of role, a change of authenticator, before executing a privileged function, after a defined idle period — have no field here at all. Deciding whether the configured ceilings match the documented circumstances is the human judgement, which is why this is partial and not full.

Two scope gaps worth writing into the assessment rather than discovering later. A console session reached through an external identity provider ends on that provider's session policy, and no AWS API reports it: the IdP's own configuration is the artifact. And aws:MultiFactorAuthAge is absent from the request context for federated identities and for requests signed with long-term access keys, so a policy that expires an MFA session governs exactly the principals using temporary MFA-backed credentials and silently governs nobody else — pair it with BoolIfExists on aws:MultiFactorAuthPresent so the not-present case denies rather than passes.

A role left at the 3600-second default is not evidence of a decision; a role at 43200 is a decision someone should have written down. Read the distribution, not the extremes. Substitute the instance and permission-set ARNs, which the two list calls supply.

## References

- {"title":"AWS CLI: iam list-roles (MaxSessionDuration in seconds; 3600 minimum, 43200 maximum)","url":"https://docs.aws.amazon.com/cli/latest/reference/iam/list-roles.html"}
- {"title":"AWS CLI: sso-admin describe-permission-set (SessionDuration — the length of time application user sessions are valid for, in the ISO-8601 standard)","url":"https://docs.aws.amazon.com/cli/latest/reference/sso-admin/describe-permission-set.html"}
- {"title":"AWS CLI: sso-admin list-instances (InstanceArn)","url":"https://docs.aws.amazon.com/cli/latest/reference/sso-admin/list-instances.html"}
- {"title":"IAM global condition keys: aws:MultiFactorAuthAge (seconds since the principal was authorized using MFA) and aws:MultiFactorAuthPresent (absent for federated identities and access-key-signed requests; use BoolIfExists)","url":"https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html"}
- {"title":"AWS CLI: iam get-account-authorization-details (policy documents are URL-encoded and must be decoded before inspection)","url":"https://docs.aws.amazon.com/cli/latest/reference/iam/get-account-authorization-details.html"}
- {"title":"AWS IAM Identity Center in AWS GovCloud (US) — permission set ARN pattern arn:aws-us-gov:sso:::permissionSet/, FIPS endpoints, no multi-Region support","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-sso.html"}