Your AWS role can't tell a human from an agent anymore, part 1: the threat model and the identity problem

Description and use

Organizations replace static AWS keys with short‑lived sessions that include source identity, limiting permissions and enabling rapid revocation to safely use AI agents.

Problem

Enterprise teams cannot safely grant AI agents long‑lived AWS credentials, leading to catastrophic credential leakage and privilege escalation.

Outcome

By moving to short‑lived, role‑based sessions with source identity and revocation, organizations can safely give AI agents limited AWS access while maintaining auditability and rapid response to misuse.

Workflow

• 1. Replace static keys with AWS IAM Identity Center (SSO) temporary sessions via aws sso login.
• 2. Create a dedicated agent IAM role with least privilege and a trust policy that allows sts:AssumeRole and sts:SetSourceIdentity with a source‑identity condition (e.g., claude-code-*).
• 3. Cap the agent role’s maximum session duration to one hour and enable session tags if needed.
• 4. Require the assume request to carry sts:SourceIdentity; downstream requests expose aws:SourceIdentity in CloudTrail.
• 5. Use IAM’s Revoke active sessions feature to terminate old sessions by attaching an inline policy with AWSRevokeOlderSessions and aws:TokenIssueTime.
• 6. Grant only necessary read/write permissions, explicitly denying secret reads and indirect data access paths.
• 7. Monitor all agent activity via CloudTrail and enforce policies through SCPs or role policies.

Evidence

The most common mistake is the same one we made before AI agents existed, just accelerated: a long‑lived aws_access_key_id sitting in ~/.aws/credentials, shared across the team, valid for months, with admin attached.

Source

Use AWS IAM Identity Center (aws sso login) with temporary sessions instead of static keys.

Source

Cap the agent role's maximum session duration. An hour is enough for a work session and short enough that a session copied off the host expires quickly; don't raise it toward the 12-hour ceiling just because you can.

Source

Give the agent its own principal, not a shared human role. In the role's trust policy, allow sts:SetSourceIdentity and require the assume request to carry sts:SourceIdentity.

Source

Use IAM’s Revoke active sessions operation: it attaches an AWSRevokeOlderSessions inline policy using aws:TokenIssueTime.

Source