Force role session name in AWS IAM
I have not tried it but I think if you change your deny to a list of elements it will work.
{
  &quot;Effect&quot;: &quot;Deny&quot;,
  &quot;Principal&quot;: {
    &quot;AWS&quot;: &quot;arn:aws:iam::&lt;redacted&gt;:root&quot;
  },
  &quot;Action&quot;: &quot;sts:AssumeRole&quot;,
  &quot;Condition&quot;: {
    &quot;StringNotLike&quot;: {
      &quot;sts:RoleSessionName&quot;: [
        &quot;${aws:username}&quot;,
        &quot;AnotherAllowedName&quot;
      ]
    }
  }
}

This will allow an IAM user to assume the role if they use their username as the session name and it will also allow other Principals to assume the role if they use &quot;AnotherAllowedName&quot; as the session name but all other session names would be declined. I found this AWS blog post helpful when researching this answer