Temporary credentials still carry authority

A short clock does not make a broad permission small.

Separate three questions

Temporary credentials have an expiry that bounds their normal acceptance for new requests. AWS STS issues them for identities such as role sessions. Their validity, permitted actions, and eligibility to obtain another session are separate review questions.

The morning report job

T1: The owner approves reading approved reports; the job never needs to delete them.

T2: Session S7 runs from 08:00 to 08:15. Its supplied permission evaluation allows both reading and deleting approved reports.

T3: The job remains eligible to request another session after S7 expires.

Assume the evaluation includes all applicable policies and conditions, the credential is valid, and the job sends an ordinary service request during the interval. T2 grants more authority than T1 requires. A fifteen-minute lifetime does not justify deletion.

Propose retaining temporary credentials while removing the unnecessary action from the applicable grant. The positive expectation is that the job can still read its approved reports; the negative expectation is that a deletion request is denied. Tie those checks to the intended role and resource scope.

At 08:15, S7 cannot authorize a new request under its expiry rules. That does not erase a report already copied or reverse a completed deletion. Nor does it stop the separately authorized issuance described in T3.

Write three findings: excess action, session expiry, and renewal eligibility. A good review assigns an owner to the renewal rule and states when the job should stop receiving sessions. If early revocation is required, record the service-supported behavior and confirmation needed; a timestamp alone is not evidence that revocation occurred.