---
cuppy_hub: aws
cuppy_path: reference/identity-center/provisioned-roles-and-sessions.md
cuppy_section: docs
cuppy_doc: X4PE-95CT
cuppy_doc_uuid: a8120cbb-b61b-4b49-b915-8104a74e56ed
cuppy_permalink: https://cuppy.io/aws/d/X4PE-95CT
cuppy_version: 4
cuppy_updated: 2026-10-23T16:16:52.575Z
cuppy_canonical: https://cuppy.io/aws/docs/reference/identity-center/provisioned-roles-and-sessions
cuppy_mcp: https://cuppy.io/mcp
cuppy_body_sha256: 26c4b1e50952e75e55240ff31e38ddde5d7f3afbd1cb24f7c8d2f671c6770d50
# cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks.
---


# Identity Center provisioned roles, session lengths and propagation

**Each permission set assigned to an account becomes an IAM role named `AWSReservedSSO_<PermissionSet>_<suffix>` in that account. Identity Center owns the role: you can't edit it in IAM.** If every assignment is removed and later re-added, the role is recreated with a **new suffix**. Never pin the exact ARN in a policy: match it with a wildcard.

## The role

| | Value |
|---|---|
| Name | `AWSReservedSSO_<permission-set-name>_<unique-suffix>` |
| ARN | `arn:aws:iam::<account>:role/aws-reserved/sso.amazonaws.com/<region>/AWSReservedSSO_<name>_<suffix>`. There is no `<region>/` segment when the identity source is in us-east-1 |
| Who can assume it | By default, only Identity Center users (that is how the permission set's session duration is enforced) |
| Max session on the role | 12 hours |
| Editable in IAM | No: `Cannot perform the operation on the protected role …`. Change the permission set instead |
| Lifecycle | Created on the first assignment of the set to the account; **deleted when the last assignment is removed** |

`aws sts get-caller-identity` from an SSO profile shows `arn:aws:sts::<account>:assumed-role/AWSReservedSSO_<name>_<suffix>/<user name>`.

## Referencing the role safely

When a policy elsewhere must name a permission-set role (an S3 bucket policy, a KMS key policy, another role's trust policy), use the account as principal and match the role with `ArnLike`:

```json
{
  "Effect": "Allow",
  "Principal": { "AWS": "arn:aws:iam::<account>:root" },
  "Action": "sts:AssumeRole",
  "Condition": { "ArnLike": {
    "aws:PrincipalArn": "arn:aws:iam::<account>:role/aws-reserved/sso.amazonaws.com/<region>/AWSReservedSSO_AdministratorAccess_*"
  } }
}
```

The wildcard keeps working after the suffix changes.

**KMS key policies and EKS `aws-auth` ConfigMaps** are where a stale ARN locks you out, because you need access to fix them. AWS recommends:

- Keep **at least one permanent assignment** of that permission set in the account (for example, an admin group), so the role is never deleted.
- Also name a **role you created in IAM** (assumable by the permission set, as above) in the key policy or ConfigMap, as a backdoor.
- For EKS, prefer **access entries** over `aws-auth`.

Without a backup role you may need AWS Support to regain access.

## Session lengths

| Session | Default | Range | Set where |
|---|---|---|---|
| Account session (console or CLI role credentials) from a permission set | 1 hour | 1–12 hours | The permission set's **Session duration**. Changing it reprovisions every account using the set |
| AWS access portal session (how long a user stays signed in to the portal) | 8 hours | up to 90 days | Identity Center settings → session duration |
| CLI | — | — | Role credentials refresh automatically while the SSO session (the portal sign-in) is valid. After that, run `aws sso login` again |

AWS recommends keeping session durations no longer than the work needs.

## How changes reach accounts

- **Console:** editing a permission set reprovisions it to every account where it is assigned. A notification confirms it.
- **API and IaC:** an assignment provisions the set when it is created, but later edits to the set are **not** pushed automatically. Call `ProvisionPermissionSet` (target one account, or `ALL_PROVISIONED_ACCOUNTS`). The concept page's statement that updates happen automatically describes the console flow.
- Assignment creation is **asynchronous**: check `DescribeAccountAssignmentCreationStatus`. `ConflictException` means a previous write hasn't propagated; retry with backoff.
- Organization instances need **multi-account permissions** turned on (the default, but optional for instances created since August 2026; enable with `UpdateInstance`).

## Permission-set contents

A permission set can hold AWS managed policies, customer managed policy **references** (the policy must exist **by that name in every assigned account**), an inline policy and a permissions boundary. If you need custom trust policies, tags or paths, assign existing IAM roles with **account access manager** instead (`reference/identity-center/permission-sets-and-access.md`).


---
<!-- cuppy -->
You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 131 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/aws/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.
<!-- /cuppy -->