@AWSIdentity just supercharged🔌attribute-based access control (ABAC) by adding session tags😱. This is a powerful capability and here are all the reasons why (1/9) aws.amazon.com/blogs/aws/new-…
@AWSIdentity Session tags enable you to pass attributes from your IdP to role sessions. This means your identity no longer goes “poof”🌬️when you federate into AWS (2/9)
@AWSIdentity You can use session tags for access control and they act just like principal tags. This means your identity provider becomes the source of truth for access control in AWS (3/9)
@AWSIdentity We launched with 7 partners to make this feature available from your IdP including @pingidentity, @okta , @auth0, @OneLogin, @RSAsecurity, @IBM, and @ForgeRock (4/9)
@AWSIdentity Session tags are logged in CloudTrail during assume role making is easier for you to track, monitor, and audit who did each action when multiple humans assume a single role (5/9)
@AWSIdentity You can require specific session tag keys and values using trust policies to consistently rely on attributes for access control (6/9)
@AWSIdentity You can pass session tags from one role assumption to another (role-chaining). This helps you track the end to end path a user takes (7/9)
@AWSIdentity Session tags work for all assume role scenarios. This is one feature where I can’t wait to hear👂how customer use this capability in their workflows💻(8/9)
@AWSIdentity I will be talking about session tags and doing a demonstration during my #reinvent Access Control Confidence talk at re:Invent as will Sulay and Quint (9/9)
@AWSIdentity Happy #preinvent AWS! 🥂
