Question

A company uses AWS IAM Identity Center integrated with an external SAML 2.0 identity provider (IdP) for workforce single sign-on across multiple AWS accounts. The security team wants each user's home region and cost-center to be passed from the IdP at sign-in so that permission sets can enforce access using policy conditions that reference these values, without creating a separate permission set per cost-center. What is the correct way to achieve this?

Accepted Answer

Configure the IdP to send additional SAML attributes and enable attributes for access control (session tags) in IAM Identity Center, then reference the attributes as aws:PrincipalTag conditions in the permission set policies.

Answer

Create one permission set per cost-center and use SCIM group membership to assign users, since IAM policies cannot evaluate externally supplied attributes.

Answer

Add the cost-center and home region as inline tags on each IAM Identity Center user and reference them with aws:ResourceTag conditions in the permission set policies.

Answer

Store the attributes in an Amazon Cognito user pool and use a pre-token Lambda trigger to inject them into the STS session before assuming the permission set role.