The Wayback Machine - https://web.archive.org/web/20220511105555/https://docs.aws.amazon.com/singlesignon/latest/userguide/abac-checklist.html
Checklist: Configuring ABAC in AWS using AWS SSO - AWS Single Sign-On

Checklist: Configuring ABAC in AWS using AWS SSO

This checklist includes the configuration tasks that are necessary to prepare your AWS resources and to set up AWS SSO for ABAC access. Complete the tasks in this checklist in order. When a reference link takes you to a topic, return back to this topic so that you can proceed with the remaining tasks in this checklist.

Step Task Reference
1 Review how to add tags to all your AWS resources. To implement ABAC in AWS SSO, you'll first need to add tags to all your AWS resources that you want to implement ABAC for.
2 Review how to configure your identity source in AWS SSO with the associated user identities and attributes in SSO. AWS SSO lets you use user attributes from any supported AWS SSO identity source for ABAC in AWS.
3 Based on the following criteria, determine which attributes you want to use for making access control decisions in AWS and send them to AWS SSO.

  • If you are using an external IdP, decide whether you want to use attributes passed from the IdP or select attributes from within AWS SSO.

  • If you choose to have your IdP send attributes, configure your IdP to transmit the attributes in SAML assertions. See the Optional sections in the procedure for your specific IdP.

  • If you use an IdP as your identity source and choose to select attributes in AWS SSO, investigate how to configure SCIM so that the attribute values come from your IdP. If you cannot use SCIM with your IdP, add the users and their attributes using the AWS SSO console's User page.

  • If you use Active Directory or AWS SSO as your identity source, or you use an IdP and choose to select attributes in AWS SSO, review the available attributes that you can configure. Then jump immediately to step 4 to start configuring your ABAC attributes using the AWS SSO console.
4

Select the attributes to use for ABAC using the Attributes for access control page in the AWS SSO console. From this page you can select attributes for access control from the identity source that you configured in step 2. After your identities and their attributes are in AWS SSO, you must create key-value pairs (mappings) which will be passed to your AWS accounts for use in access control decisions.

5

Create custom permissions policies within your permission set and use access control attributes to create ABAC rules so that users can only access resources with matching tags. User attributes that you configured in step 4 are used as tags in AWS for access control decisions. You can refer to the access control attributes in the permissions policy using the aws:PrincipalTag/key condition.

6

In your various AWS accounts, assign users to permissions sets you created in step 5. Doing so ensures that when they federate into their accounts and access AWS resources, they only get access based on matching tags.

Once you have completed this checklist, users that federate into an AWS account using SSO will get access to their AWS resources based on matching attributes.