Question

Difficulty: Very hardIdentity and Access Management (IAM)

A financial company uses a central identity AWS account to federate user logins from an external OIDC-compliant Identity Provider (IdP). Developers must perform administrative tasks on Amazon EC2 instances and Amazon RDS databases in multiple application-specific AWS accounts. The security team mandates that access must be granted dynamically based on the developer’s active project assignment, which is stored as a custom attribute in the IdP. The solution must enforce Attribute-Based Access Control (ABAC), support temporary credentials, and ensure no credentials or user profiles are manually maintained in the target application accounts. Which combination of actions will meet these requirements securely?

  1. Configure the external IdP to send the project attribute as a session tag in the OIDC token. In the central identity account, allow the IAM role assumed by developers to transitively pass session tags. In each application account, configure the trust policy of the target IAM role to trust the identity account and permit the sts:AssumeRole and sts:TagSession actions. Attach an identity-based policy to the target role that allows EC2 and RDS actions only when the resource's project tag matches the principal tag aws:PrincipalTag/Project.Answer
  2. B
    Create individual IAM users in each target application account corresponding to each developer in the identity provider. Use a cron job on an EC2 instance to synchronize project tags from the external IdP to each IAM user daily. Attach a permission policy to the IAM users that grants access to EC2 and RDS resources only if the aws:PrincipalTag/Project tag matches the resource's project tag.
  3. C
    Use the AWS account root user of each target application account to create a direct OpenID Connect (OIDC) identity provider configuration. Grant administrative permissions directly to the root user's execution space, allowing federated users to access resources without the overhead of assuming cross-account IAM roles.
  4. D
    Store the developers' IdP session tokens and database credentials as plaintext String parameters in AWS Systems Manager Parameter Store in the central identity account. Create an IAM role in each application account that retrieves these parameters to verify the project attribute and authenticate access requests.

Answer

The configuration using session tags in the IdP, transitively passing them through sts:TagSession in trust policies, and using aws:PrincipalTag/Project for ABAC.
The correct solution leverages native AWS federation and Attribute-Based Access Control (ABAC). By configuring the external IdP to pass the project attribute as a session tag and allowing the sts:TagSession action in the cross-account trust policy, developers can securely carry their attributes across AWS accounts. In the destination accounts, the target role's identity policy compares the resource tag with the principal's session tag (using the aws:PrincipalTag/Project key), ensuring that access is granted dynamically without manually managing IAM users or static credentials in each environment.

Step-by-Step Solution

1
Configure OIDC and pass Attributes as Tags
The external IdP passes the project attribute as a session tag (e.g., Project) within the SAML assertion or OIDC token during authentication.
This allows AWS to receive the user's identity attributes as session tags, which is the foundation of Attribute-Based Access Control (ABAC).
2
Configure cross-account delegation with TagSession trust
In the application accounts, the cross-account role's trust policy is configured to trust the central identity account and explicitly allow the action sts:TagSession in addition to sts:AssumeRole.
The sts:TagSession action is required to permit the calling identity in the central account to transitively pass session tags to the role in the target application account.
3
Implement ABAC evaluation logic in the target role's permission policy
An identity-based policy attached to the target role in the application account allows EC2 and RDS actions only when the resource's project tag matches the context key aws:PrincipalTag/Project.
The aws:PrincipalTag/Project context key evaluates the Project session tag of the principal (developer) against the resource's tags to authorize access dynamically.

Key Concept

Federated Attribute-Based Access Control (ABAC) using IAM Session Tags and cross-account sts:TagSession trust policies.
Estimated Time:3m 0s
Rate this question