Question

A company uses AWS IAM Identity Center (successor to AWS SSO) with an external SAML 2.0 identity provider. Workforce users are assigned to multiple AWS accounts through permission sets. The security team wants to grant each user access only to EC2 instances tagged with their department, without creating a separate permission set per department, and without editing policies whenever a new department is added. Which approach best achieves this at scale?

Accepted Answer

Configure the identity provider to pass a department attribute as a session tag, enable attribute-based access control (ABAC) in IAM Identity Center, and write permission set policies that use aws:PrincipalTag/department conditions matching resource tags.

Answer

Create one permission set per department with inline policies scoped to each department's resource tags, and reassign users whenever their department changes.

Answer

Attach a permission boundary to each permission set that denies access to any EC2 instance not tagged with the department, and update the boundary as departments are added.

Answer

Use an SCP at the organization root that restricts EC2 access based on the user's department tag propagated from the identity provider.