A financial company uses a central identity AWS account to federate user logins from an external OIDC-compliant Identity Provider (IdP). Developers must perform administrative tasks on Amazon EC2 instances and Amazon RDS databases in multiple application-specific AWS accounts. The security team mandates that access must be granted dynamically based on the developer’s active project assignment, which is stored as a custom attribute in the IdP. The solution must enforce Attribute-Based Access Control (ABAC), support temporary credentials, and ensure no credentials or user profiles are manually maintained in the target application accounts. Which combination of actions will meet these requirements securely?
- Configure the external IdP to send the project attribute as a session tag in the OIDC token. In the central identity account, allow the IAM role assumed by developers to transitively pass session tags. In each application account, configure the trust policy of the target IAM role to trust the identity account and permit the sts:AssumeRole and sts:TagSession actions. Attach an identity-based policy to the target role that allows EC2 and RDS actions only when the resource's project tag matches the principal tag aws:PrincipalTag/Project.Answer
- BCreate individual IAM users in each target application account corresponding to each developer in the identity provider. Use a cron job on an EC2 instance to synchronize project tags from the external IdP to each IAM user daily. Attach a permission policy to the IAM users that grants access to EC2 and RDS resources only if the aws:PrincipalTag/Project tag matches the resource's project tag.
- CUse the AWS account root user of each target application account to create a direct OpenID Connect (OIDC) identity provider configuration. Grant administrative permissions directly to the root user's execution space, allowing federated users to access resources without the overhead of assuming cross-account IAM roles.
- DStore the developers' IdP session tokens and database credentials as plaintext String parameters in AWS Systems Manager Parameter Store in the central identity account. Create an IAM role in each application account that retrieves these parameters to verify the project attribute and authenticate access requests.
Answer
The configuration using session tags in the IdP, transitively passing them through sts:TagSession in trust policies, and using aws:PrincipalTag/Project for ABAC.
The correct solution leverages native AWS federation and Attribute-Based Access Control (ABAC). By configuring the external IdP to pass the project attribute as a session tag and allowing the sts:TagSession action in the cross-account trust policy, developers can securely carry their attributes across AWS accounts. In the destination accounts, the target role's identity policy compares the resource tag with the principal's session tag (using the aws:PrincipalTag/Project key), ensuring that access is granted dynamically without manually managing IAM users or static credentials in each environment.
Step-by-Step Solution
Key Concept
Federated Attribute-Based Access Control (ABAC) using IAM Session Tags and cross-account sts:TagSession trust policies.
Estimated Time:3m 0s