Question

A company uses AWS IAM Identity Center integrated with an external SAML 2.0 identity provider (IdP) for workforce single sign-on. Users are provisioned into Identity Center via SCIM from the IdP. Security requires that when an employee is terminated in the IdP, their ability to obtain new AWS access is revoked promptly, but they are concerned that already-active AWS CLI sessions could remain valid for hours. The current permission sets use the default 1-hour session duration. Which combination of actions BEST meets the requirement to limit lingering access after deprovisioning?

Accepted Answer

Ensure SCIM deprovisioning disables the user in Identity Center to block new sign-ins, and keep permission set session durations short so any active credentials expire quickly.

Answer

Rely on SCIM to automatically terminate all active AWS STS sessions the moment the user is disabled in the IdP.

Answer

Increase the permission set session duration to 12 hours so administrators have time to manually revoke sessions after termination.

Answer

Attach an SCP to the organization that denies all actions from terminated users based on their IdP username.