in app/aws/Federation.scala [204:221]
private def denyOlderSessionsPolicyDocument(after: Instant): String = {
val revocationTime = Date.isoDateString(after)
s"""{
| "Version": "2012-10-17",
| "Statement": [
| {
| "Effect": "Deny",
| "Action": [ "*" ],
| "Resource": [ "*" ],
| "Condition": {
| "DateLessThan": {
| "aws:TokenIssueTime": "$revocationTime"
| }
| }
| }
| ]
|}""".stripMargin
}