Answers: <p>I have not tried it but I think if you change your deny to a list of elements it will work.</p>
  <pre><code>{
    &quot;Effect&quot;: &quot;Deny&quot;,
    &quot;Principal&quot;: {
      &quot;AWS&quot;: &quot;arn:aws:iam::&lt;redacted&gt;:root&quot;
    },
    &quot;Action&quot;: &quot;sts:AssumeRole&quot;,
    &quot;Condition&quot;: {
      &quot;StringNotLike&quot;: {
        &quot;sts:RoleSessionName&quot;: [
          &quot;${aws:username}&quot;,
          &quot;AnotherAllowedName&quot;
        ]
      }
    }
  }
  </code></pre>
  <p>This will allow an IAM user to assume the role if they use their username as the session name and it will also allow other Principals to assume the role if they use &quot;AnotherAllowedName&quot; as the session name but all other session names would be declined. I found this AWS <a href="https://aws.amazon.com/blogs/security/easily-control-naming-individual-iam-role-sessions/" rel="nofollow noreferrer">blog post</a> helpful when researching this answer</p>
  
Answers: CC BY-SA 4.0
Answers: 2020-09-01T20:47:19.827Z
Answers: I'm afraid it does not solve my problem. I want the role session name to match username. `AnotherAllowedName` would not fulfill this requirement.
Answers: pmichna
Answers: CC BY-SA 4.0
Answers: 2020-09-02T10:04:01.483Z
Answers: @pmichna Then I dont think it will be possible. As you said, the ${aws:username} variable is only available when IAM users are the principal. If your usernames in AWS contain your companies domain you might be able to do something like "*@mycompany.com" which might remind them they need to use their emails.
Answers: Levi
Answers: CC BY-SA 4.0
Answers: 2020-09-01T19:47:08.293Z
Answers: 2020-09-01T19:47:08.293Z
Answers: Levi
Body: <p>I want to enforce users to use their IAM username as the role session name when assuming a role in AWS. I've tried the following condition in IAM policies:</p>
  <pre><code>{
    &quot;Effect&quot;: &quot;Allow&quot;,
    &quot;Principal&quot;: {
      &quot;AWS&quot;: &quot;arn:aws:iam::&lt;redacted&gt;:root&quot;
    },
    &quot;Action&quot;: &quot;sts:AssumeRole&quot;,
    &quot;Condition&quot;: {
      &quot;StringLike&quot;: {
        &quot;sts:RoleSessionName&quot;: &quot;${aws:username}&quot;
      }
    }
  }
  </code></pre>
  <p>While this works fine when assuming a role as a user it does not work when assuming a role from a role with administrator privileges (<code>Allow * on *</code>). The only way to block this would be an explicit <code>Deny</code> when a role tries to assume a given role and does not have session name set up. Any ideas how to write a policy doing this? A simple <code>Deny</code> like below does not work because <code>aws:username</code> is not present when <code>Assumed Role</code> is the principal (see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_variables.html" rel="nofollow noreferrer">docs</a>).</p>
  <pre><code>{
    &quot;Effect&quot;: &quot;Deny&quot;,
    &quot;Principal&quot;: {
      &quot;AWS&quot;: &quot;arn:aws:iam::&lt;redacted&gt;:root&quot;
    },
    &quot;Action&quot;: &quot;sts:AssumeRole&quot;,
    &quot;Condition&quot;: {
      &quot;StringNotLike&quot;: {
        &quot;sts:RoleSessionName&quot;: &quot;${aws:username}&quot;
      }
    }
  }
  </code></pre>
  
Tags: <amazon-web-services><aws-iam>
Title: Force role session name in AWS IAM
UserDisplayName: pmichna
ThreadText: # Force role session name in AWS IAM
  
  (Asked by: username_0 on 2020-09-01)
  
  I want to enforce users to use their IAM username as the role session name when assuming a role in AWS. I've tried the following condition in IAM policies:
  
  ```
  {
    "Effect": "Allow",
    "Principal": {
      "AWS": "arn:aws:iam::<redacted>:root"
    },
    "Action": "sts:AssumeRole",
    "Condition": {
      "StringLike": {
        "sts:RoleSessionName": "${aws:username}"
      }
    }
  }
  
  ```
  
  While this works fine when assuming a role as a user it does not work when assuming a role from a role with administrator privileges (`Allow * on *`). The only way to block this would be an explicit `Deny` when a role tries to assume a given role and does not have session name set up. Any ideas how to write a policy doing this? A simple `Deny` like below does not work because `aws:username` is not present when `Assumed Role` is the principal (see [docs](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_variables.html)).
  
  ```
  {
    "Effect": "Deny",
    "Principal": {
      "AWS": "arn:aws:iam::<redacted>:root"
    },
    "Action": "sts:AssumeRole",
    "Condition": {
      "StringNotLike": {
        "sts:RoleSessionName": "${aws:username}"
      }
    }
  }
  
  ```
  
  **Tags:** amazon-web-services, aws-iam
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2020-09-01. Score: 2
  
  I have not tried it but I think if you change your deny to a list of elements it will work.
  
  ```
  {
    "Effect": "Deny",
    "Principal": {
      "AWS": "arn:aws:iam::<redacted>:root"
    },
    "Action": "sts:AssumeRole",
    "Condition": {
      "StringNotLike": {
        "sts:RoleSessionName": [
          "${aws:username}",
          "AnotherAllowedName"
        ]
      }
    }
  }
  
  ```
  
  This will allow an IAM user to assume the role if they use their username as the session name and it will also allow other Principals to assume the role if they use "AnotherAllowedName" as the session name but all other session names would be declined. I found this AWS [blog post](https://aws.amazon.com/blogs/security/easily-control-naming-individual-iam-role-sessions/) helpful when researching this answer
  
  > **Comments:**
  > **username_0**: I'm afraid it does not solve my problem. I want the role session name to match username. `AnotherAllowedName` would not fulfill this requirement.  
  > **username_1**: @username_0 Then I dont think it will be possible. As you said, the ${aws:username} variable is only available when IAM users are the principal. If your usernames in AWS contain your companies domain you might be able to do something like "*@mycompany.com" which might remind them they need to use their emails.  
  
  ---
  
  