This article provides the steps to apply Session Tags to Amazon Web Services (AWS) IAM SAML configuration.

Before You Begin

Ensure SAML is configured and working. For details, refer to Amazon Web Services IAM - SAML My Page SSO Configuration - RSA Ready Implementation Guide.

My Page SSO

Configure RSA Cloud Access Service

Perform these steps to configure Cloud Access Service (CAS).

Procedure

1. Sign in to RSA Cloud Administration Console.
2. Go to Applications > Applications.
3. Locate the SAML application created for AWS IAM and edit it.
4. On the Connection Profile page, navigate to Message Protection > Connection Profile Advanced Configuration > Statement Attributes and make the following updates.

   Field	Value
   Attribute Name	https://aws.amazon.com/SAML/Attributes/PrincipalTag:{TagKey} Replace {Tagkey} with your key.  We have used https://aws.amazon.com/SAML/Attributes/PrincipalTag:Department
   Attribute Source	Identity source available in CAS of which the user is a part or Constant.
   Property	Value of the Tag key. We have used Finance.

   
         

5. Save the changes to the application and click Publish Changes.

Configure AWS IAM 

Perform these steps to configure AWS IAM.

Procedure

1. Navigate to the AWS IAM Management console.
2. Click IAM > Roles and search for the role that will employ the use session tags. We have selected ReadbillingRole.
3. Go to the Trust relationships tab and edit the trust policy. Add sts:TagSession to the Action block and add condition for the session tag. The trust policy should be updated to match the configuration shown in the following image.
   

Important: AWS role will reject access request to a role without sts:TagSession action if the SAML assertions contain session tags. If multiple roles are passed by IDP for a user in SAML configuration like we have used for this integration and any one or more of the role[s] employ session tags it is important to add sts:TagSession in the action segment of the trust policy for every role. Do not add conditions for non-applicable roles. By employing this design, users in same department will be authorized to same features with certain employees having access to additional features.

4. Update the other roles with sts:TagSession action.
   

 The configuration is complete.

User Experience

My Page

1. Log in to My Page and click the application created.
   
2. Select the role and click Sign in.
   
   User is logged in with the role assigned.
      
   
   If the logged-in user belongs to the Finance department (that is, the IdP sends a session tag with the value Finance), the user can assume the ReadbillingRole in addition to the IAMReadonly role. Logged-in users without a session tag value of Finance can assume only the IAMReadonly role and cannot assume the ReadbillingRole.

Note: Roles and permissions can be implemented in several ways. This guide illustrates one method of integrating RSA SAML with session tags. For the optimal design for your specific use case, see the AWS documentation.