Question

A company uses AWS IAM Identity Center (successor to AWS SSO) with an external SAML 2.0 identity provider for workforce federation. Users are provisioned via SCIM. The security team requires that finance analysts, who assume a permission set into a production account, can only hold active credentials for a maximum of 1 hour, while also ensuring that any employee removed from the finance group in the corporate directory loses access automatically. Which combination of actions BEST meets these requirements?

Accepted Answer

Set the session duration on the finance permission set to 1 hour, and rely on SCIM provisioning to deprovision users automatically when they are removed from the finance group.

Answer

Configure a session policy in the SAML assertion limiting the token to 1 hour, and manually delete the user from IAM Identity Center when they leave the finance group.

Answer

Attach a permission boundary with an aws:CurrentTime condition to the permission set, and configure an EventBridge rule to remove users nightly.

Answer

Set the IAM role maximum session duration to 1 hour in the target account, and use an SCP to deny access outside the finance group.