An enterprise manages a multi-account AWS environment using AWS Organizations. The organization has set up AWS IAM Identity Center in a delegated administrator security account, integrated with Okta as the external identity provider (IdP) via SAML 2.0 and SCIM. The security team is implementing Attribute-Based Access Control (ABAC) to restrict access to sensitive Amazon S3 buckets located in a Shared Services account. Corporate users must only access buckets where the bucket's CostCenter tag matches their corporate cost center, which is stored in Okta as the costCenter profile attribute.
During testing, two issues are observed:
1. Users federated through AWS IAM Identity Center are denied access to the S3 buckets in the Shared Services account, despite having the correct costCenter value in Okta and matching tags on the S3 buckets.
2. A legacy third-party auditing tool that bypasses IAM Identity Center and federates directly via a custom IAM SAML identity provider in each member account fails to assume its target role, returning an 'Access Denied' error when attempting to pass the cost center as a session tag.
Which of the following actions must the Solutions Architect take to resolve these issues? (Select TWO.)
- Enable 'Attributes for access control' in AWS IAM Identity Center and map the SCIM attribute costCenter to the key CostCenter. Ensure the IAM policy attached to the permission sets in the member accounts explicitly grants permissions to the S3 buckets in the Shared Services account, rather than relying on Service Control Policies (SCPs) to grant the permissions.Answer
- In the member accounts, update the trust policy of the IAM role used by the auditing tool to include the sts:TagSession action in addition to sts:AssumeRoleWithSAML. Configure the Okta SAML assertion to include the cost center attribute under the https://aws.amazon.com/SAML/Attributes/PrincipalTag:CostCenter attribute namespace.Answer
- CCreate a Service Control Policy (SCP) at the Root OU level that allows S3 actions with a condition matching aws:PrincipalTag/CostCenter and aws:ResourceTag/CostCenter. Detach all S3-related permissions from the IAM Identity Center permission sets in member accounts to ensure that access control is managed centrally by the organization's governance boundary.
- DIn the member accounts, update the trust policy of the IAM role used by the auditing tool. Replace sts:AssumeRoleWithSAML with sts:AssumeRole and grant the Okta integration service account's IAM role the permission to assume the auditing role, using the aws:PrincipalTag/CostCenter condition in the trust policy.
- EConfigure AWS IAM Identity Center to use an AWS-managed KMS key for the S3 buckets in the Shared Services account. Modify the default key policy to automatically propagate user attributes as session tags, ensuring that the aws:PrincipalTag/CostCenter condition can be evaluated by AWS KMS during cross-account access.