Question

A company federates workforce users into AWS using IAM Identity Center-independent SAML federation directly to IAM. When users assume the role via AssumeRoleWithSAML, the identity provider passes a 'Department' attribute as a session tag. A downstream service team wants users, after assuming the initial federated role, to chain into a second role in another account that grants access only to resources tagged with the same Department value. During testing, the second AssumeRole call succeeds, but the ABAC conditions on the resource fail because the Department session tag is not present in the second session. What is the cause and the correct fix?

Accepted Answer

Session tags are not automatically forwarded during role chaining; the tags must be set as transitive tags in the first AssumeRoleWithSAML request so they persist through the subsequent AssumeRole call.

Answer

Session tags cannot be used with SAML federation at all; the department value must instead be encoded into the role's trust policy as a static condition key.

Answer

The second role's permissions policy must include an sts:TagSession action; without it, tags are stripped when the second session is created.

Answer

Session tags only work within a single account; cross-account role chaining requires passing the Department value as a resource tag on the destination role instead.