Question

A company uses a custom identity broker that authenticates employees against an on-premises Active Directory and then calls AWS STS AssumeRole to grant temporary credentials. All employees assume the same IAM role, DataAnalystRole, which has permissions to read all objects in a large S3 data lake. Compliance now requires that each analyst session be dynamically scoped so a user can only access the S3 prefix for their assigned business unit, WITHOUT creating a separate IAM role per business unit and WITHOUT modifying the DataAnalystRole's attached identity policy. What should the identity broker do when calling STS?

Accepted Answer

Pass an inline session policy in the AssumeRole call that limits S3 access to the user's business-unit prefix; effective permissions become the intersection of the role policy and the session policy.

Answer

Attach a permissions boundary to DataAnalystRole for each business unit before calling AssumeRole so the boundary caps the session to the correct prefix.

Answer

Add the business-unit prefix restriction as a Deny statement in the S3 bucket resource policy keyed on the role's ARN.

Answer

Call GetFederationToken instead of AssumeRole so the broker can embed the user identity directly in the credentials.