A multinational enterprise manages a multi-account AWS environment under AWS Organizations. The enterprise integrates its on-premises SAML 2.0 Identity Provider (IdP) directly with target AWS member accounts to federate corporate directories. The security team wants to implement a global Attribute-Based Access Control (ABAC) strategy using the corporate attributes `CostCenter` and `Project`. The IdP is configured to send these attributes as SAML assertions mapped to AWS principal tags (`PrincipalTag:CostCenter` and `PrincipalTag:Project`).
The security team creates a standard IAM role named `ProjectContributorRole` in each member account. The local permission policies are configured to allow actions only when the resource's `CostCenter` tag matches the user's `CostCenter` principal tag. However, during initial testing, corporate users receive an error and are unable to log in to AWS when attempting to federate.
Which combination of configurations will resolve the login failures and securely enforce the cross-account ABAC boundaries across all organization accounts?
- Ensure the trust policy of `ProjectContributorRole` in each member account permits both the `sts:AssumeRoleWithSAML` and `sts:TagSession` actions for the SAML Identity Provider ARN. Implement an Organization-wide Service Control Policy (SCP) at the root level that explicitly denies any action if the request does not carry the `aws:PrincipalTag/CostCenter` tag or if it does not match the target resource's `aws:ResourceTag/CostCenter` tag.Cevap
- BEnsure the trust policy of `ProjectContributorRole` in each member account permits only the `sts:AssumeRoleWithSAML` action for the SAML Identity Provider ARN. Modify the SAML assertion in the IdP to map the `CostCenter` and `Project` attributes to standard SAML Session Attributes rather than principal tags, thereby bypassing the requirement for `sts:TagSession` authorization.
- CEnsure the trust policy of `ProjectContributorRole` in each member account permits both the `sts:AssumeRoleWithSAML` and `sts:TagSession` actions. Create an Organization-wide Service Control Policy (SCP) that explicitly grants read and write access to resources when `aws:PrincipalTag/CostCenter` matches `aws:ResourceTag/CostCenter`, allowing you to delete the local permission policies from the role in each member account to simplify management.
- DEnsure the trust policy of `ProjectContributorRole` in each member account permits the `sts:AssumeRole` action for the SAML Identity Provider principal. Configure an IAM Policy at the Organization level that maps the SAML assertion attributes to transient IAM policy variables, and attach it to the root of the organization.