Question

A global enterprise uses AWS IAM Identity Center federated with an external corporate SAML identity provider. The finance team wants to allocate costs of engineer-driven activity in a shared workload account by cost center. Each engineer's IdP profile already contains a 'costCenter' attribute. The security team requires that AWS API calls made through federated sessions carry the engineer's cost center so it can be used both in IAM policy conditions and reflected in AWS CloudTrail for later cost analysis, without creating separate permission sets per cost center. What is the MOST appropriate way to achieve this?

Accepted Answer

Enable attribute-based access control (ABAC) in IAM Identity Center, configure the 'costCenter' attribute to be passed as a session tag from the external IdP, and reference the aws:PrincipalTag/costCenter key in permission set policies.

Answer

Create a separate permission set for each cost center and use SCPs in AWS Organizations to restrict which permission sets can be assumed based on the user's OU membership.

Answer

Configure an AWS Lambda function triggered by CloudTrail to look up each engineer's cost center in the IdP and rewrite the CloudTrail event records with the appropriate cost allocation tag.

Answer

Use AWS Organizations tag policies to enforce a 'costCenter' tag on all resources created in the shared account and rely on AWS Cost Explorer to group spend by that resource tag.