Question

A company uses AWS IAM Identity Center (successor to AWS SSO) federated with an external SAML identity provider. The security team wants users to access only the AWS resources tagged with the same cost center as the user, without creating a separate permission set per cost center. Each user's cost center is stored as an attribute in the corporate IdP. Which approach BEST meets this requirement while minimizing the number of permission sets to maintain?

Accepted Answer

Enable attributes for access control (ABAC) in IAM Identity Center, map the IdP cost-center attribute to a session tag, and write a permission set policy that uses a condition matching the resource tag to the aws:PrincipalTag/costcenter key.

Answer

Create one permission set per cost center and assign each user to the matching permission set based on their group membership in the external IdP.

Answer

Configure a permission boundary on each permission set that denies access unless the user's IAM user name matches the resource cost-center tag.

Answer

Use an SCP at the organization root that denies access to resources whose tags do not match a hardcoded list of cost centers.