Question

A global enterprise uses AWS IAM Identity Center federated with an external SAML identity provider to grant workforce users access across 200 accounts in AWS Organizations. Security requires that developers accessing the production OU can hold their federated console and CLI sessions for no more than 1 hour before reauthentication, while the same developers accessing the sandbox OU may keep sessions for up to 12 hours. Both groups of accounts are assigned using the same permission set today. The team wants the least-effort, centrally managed solution that enforces the differing session lifetimes without creating separate identity providers. What should the solution architect recommend?

Accepted Answer

Create two permission sets with different session duration values, and assign the shorter-duration permission set to the production accounts and the longer-duration permission set to the sandbox accounts for the developer group.

Answer

Set a single permission set session duration to 1 hour and use an SCP on the sandbox OU that grants sts:GetSessionToken with a 12-hour DurationSeconds condition.

Answer

Configure the external SAML IdP to issue two different SAML assertions with distinct SessionDuration attributes based on which OU the user targets, keeping one Identity Center permission set.

Answer

Enable IAM Identity Center session management with a global 12-hour setting and rely on a CloudWatch Events rule to force logout of production sessions after 1 hour.