AWS has updated the default session duration for IAM Identity Center, reducing the default timeout from 12 hours to 8 hours. The change affects federated access sessions — the temporary credentials issued when users sign in through IAM Identity Center to access AWS accounts and applications.
The reduction means users who previously stayed authenticated for a full workday without interruption will now be prompted to re-authenticate. For most teams this is a minor friction change, but it can catch developer workflows off guard if long-running scripts or CI/CD pipelines rely on user-session credentials rather than dedicated IAM roles.
The security rationale is straightforward: shorter session windows reduce the exposure window if a session token is compromised. An 8-hour token that gets stolen has a shorter useful life than a 12-hour one.
If you’re using IAM Identity Center, check your permission sets for custom session duration overrides — those aren’t affected by this default change, but it’s worth reviewing whether the overrides you have in place are still justified. Automated workloads should always use dedicated IAM roles with scoped permissions rather than inheriting user session credentials.