This article provides the steps to apply Session Tags to AWS IAM Identity Center SAML configuration.

Before You Begin

Ensure SAML is configured and working. For details, refer to AWS IAM Identity Center - SAML My Page SSO Configuration - RSA Ready Implementation Guide and AWS IAM Identity Center - SAML Relying Party Configuration - RSA Ready Implementation Guide.

My Page SSO

Configure RSA Cloud Access Service

Perform these steps to configure Cloud Access Service (CAS).

Procedure

1. Sign in to RSA Cloud Administration Console. 
2. Go to Applications > Applications.
3. Locate the SAML application created for AWS IAM Identity Center and edit it.
4. On the Connection Profile page, make the following updates to Statement Attributes.
   

   Field		Value/Description
   Statement Attributes	Attribute Name	https://aws.amazon.com/SAML/Attributes/AccessControl:{TagKey} Replace {Tagkey} with your key. We have used Department here.
   	Attribute Source	Identity source available in CAS of which the user is a part, or Constant.
   	Property	Value of the Tag key. We have used eng.

   
   
        
5. Save the changes and click Publish Changes.

Configure AWS IAM Identity Center

Perform these steps to configure AWS IAM Identity Center.

Procedure

1. Log in to the AWS IAM Identity Center console. 
2. Under Settings > Attributes, enable Attributes for access control.
   

Important: Do not add any key-value pairs to the session attributes on this page. Any key-value pair added here will have precedence over the key-value pair sent by RSA.

3. In the AWS IAM Identity Center console:

   1. Go to Multi-account permissions > Permission sets > Select the permission set.

   2. Under the Permissions tab, locate the inline policy created and edit it.

   3. Choose to add the condition and ensure you add the condition as shown in the following image.
      

   4. Verify that your policy looks like the following.
      
   5. Save the changes.

The configuration is complete.

Relying Party

Configure CAS

Perform these steps to configure Cloud Access Service (CAS).

Procedure

1. Sign in to RSA Cloud Administration Console. 
2. Go to Authentication Clients > Relying Parties.
3. Locate the Relying Party application created for AWS IAM Identity Center and edit it.
4. On the Connection Profile page, make the following updates to Statement Attributes.
   

   Field	Value/Description
   Statement Attributes
   Attribute Name	https://aws.amazon.com/SAML/Attributes/AccessControl:{TagKey} Replace {Tagkey} with your key. We have used Department here.
   Attribute Source	Identity source available in CAS of which the user is a part, or Constant.
   Property	Value of the Tag key. We have used eng.

   
   
        
5. Save the changes and click Publish Changes.

Configure AWS IAM Identity Center

Perform these steps to configure AWS IAM Identity Center.

Procedure

1. Log in to the AWS IAM Identity Center console. 
2. Under Settings > Attributes, enable Attributes for access control.
   

Important: Do not add any key-value pairs to the session attributes on this page. Any key-value pair added here will have precedence over the key-value pair sent by RSA.

3. In the AWS IAM Identity Center console:

   1. Go to Multi-account permissions > Permission sets > Select the permission set.

   2. Under the Permissions tab, locate the inline policy created and edit it.

   3. Choose to add the condition and ensure you add the condition as shown in the following image.
      

   4. Verify that your policy looks like the following.
      
   5. Save the changes.

 The configuration is complete.

User Experience

My Page

1. Log in to My Page and click the created application.
   
2. Select the Account Name and the Role.
   
3. Click Account.
   
4. Verify the permissions are correctly assigned.
   
5. Remove the attributes from CAS and notice the permissions are not available anymore.
   

Relying Party

Navigate to the AWS access portal URL from the IAM Identity Center console > Settings > Identity source and follow the same process as mentioned in the previous section.