Administrators can use custom attributes from Microsoft Entra ID to provide attribute-based access control (ABAC) for AWS resources by passing custom attributes as session tags in SAML assertions integrated with AWS IAM Identity Center, enabling fine-grained permissions based on attribute values.

<div>
<p>This article explains how to use custom attributes from Microsoft Entra ID (formerly Azure AD) for attribute-based access control (ABAC) in AWS IAM Identity Center (formerly AWS SSO). It provides a solution to control access to AWS resources like Amazon EC2 instances based on custom attributes like project assignment and handover phase.</p>
<p>Specifically, the article covers:</p>
<ul>
<li>Overview of the solution using Microsoft Entra ID custom attributes as SAML claims</li>
<li>Prerequisites like a configured Microsoft Entra ID tenant and AWS account</li>
<li>Detailed walkthrough with steps to create groups, assign attributes, configure SAML claims, create IAM permission set, assign permissions, and test access</li>
<li>Example scenarios demonstrating controlling EC2 access based on project assignment and handover phase</li>
<li>Verifying custom attributes passed as session tags in AWS CloudTrail logs</li>
<li>Cleanup steps to remove the test resources</li>
</ul>
</div>


Related articles