Appendix G. Examples using session tags for Attribute-based access control in STS The following list contains examples of the usage of session tags for Attribute-based access control (ABAC) in STS. Example of session tags that are passed in by Keycloak in the web token Example of aws:RequestTag Example of aws:PrincipalTag Example of aws:ResourceTag 1 1 1 For the above to work, you need to attach the 'Department=Engineering' tag to the role. Example of aws:TagKeys 1 ForAllValues:StringEquals tests whether every tag key in the request is a subset of the tag keys in the policy. Therefore, the condition restricts the tag keys passed in the request. Example of s3:ResourceTag 1 For the above to work, you need to attach the 'Department=Engineering' tag to the bucket or object on which you want this policy to be applied. Example of aws:RequestTag with iam:ResourceTag 1 This is to assume a role by matching the tags in the incoming request with the tag attached to the role. aws:RequestTag is the incoming tag in the JSON Web Token (JWT) and iam:ResourceTag is the tag attached to the role being assumed. Example of aws:PrincipalTag with s3:ResourceTag 1 This is to evaluate a role permission policy by matching principal tags with S3 resource tags. aws:PrincipalTag is the tag passed in along with the temporary credentials and s3:ResourceTag is the tag attached to the S3 resource, that is object or bucket.

Commands:
{ "jti": "947960a3-7e91-4027-99f6-da719b0d4059", "exp": 1627438044, "nbf": 0, "iat": 1627402044, "iss": "http://localhost:8080/auth/realms/quickstart", "aud": "app-profile-jsp", "sub": "test", "typ": "ID", "azp": "app-profile-jsp", "auth_time": 0, "session_state": "3a46e3e7-d198-4a64-8b51-69682bcfc670", "preferred_username": "test", "email_verified": false, "acr": "1", "https://aws.amazon.com/tags": [ { "principal_tags": { "Department": [ "Engineering", "Marketing" ] } } ], "client_id": "app-profile-jsp", "username": "test", "active": true }
{ "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":["sts:AssumeRoleWithWebIdentity","sts:TagSession"], "Principal":{"Federated":["arn:aws:iam:::oidc-provider/localhost:8080/auth/realms/quickstart"]}, "Condition":{"StringEquals":{"aws:RequestTag/Department":"Engineering"}} }] }
{ "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":["s3:*"], "Resource":["arn:aws:s3::t1tenant:my-test-bucket","arn:aws:s3::t1tenant:my-test-bucket/*],"+ "Condition":{"StringEquals":{"aws:PrincipalTag/Department":"Engineering"}} }] }
{ "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":["sts:AssumeRoleWithWebIdentity","sts:TagSession"], "Principal":{"Federated":["arn:aws:iam:::oidc-provider/localhost:8080/auth/realms/quickstart"]}, "Condition":{"StringEquals":{"iam:ResourceTag/Department":"Engineering"}} 1 }] }
{ "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":["sts:AssumeRoleWithWebIdentity","sts:TagSession"], "Principal":{"Federated":["arn:aws:iam:::oidc-provider/localhost:8080/auth/realms/quickstart"]}, "Condition":{"ForAllValues:StringEquals":{"aws:TagKeys":["Marketing,Engineering"]}} 1 }] }
{ "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":["s3:PutBucketTagging"], "Resource":["arn:aws:s3::t1tenant:my-test-bucket\","arn:aws:s3::t1tenant:my-test-bucket/*"] }, { "Effect":"Allow", "Action":["s3:*"], "Resource":["*"], "Condition":{"StringEquals":{"s3:ResourceTag/Department":\"Engineering"}} 1 } }
{ "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":["sts:AssumeRoleWithWebIdentity","sts:TagSession"], "Principal":{"Federated":["arn:aws:iam:::oidc-provider/localhost:8080/auth/realms/quickstart"]}, "Condition":{"StringEquals":{"aws:RequestTag/Department":"USD{iam:ResourceTag/Department}"}} 1 }] }
{ "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":["s3:PutBucketTagging"], "Resource":["arn:aws:s3::t1tenant:my-test-bucket\","arn:aws:s3::t1tenant:my-test-bucket/*"] }, { "Effect":"Allow", "Action":["s3:*"], "Resource":["*"], "Condition":{"StringEquals":{"s3:ResourceTag/Department":"USD{aws:PrincipalTag/Department}"}} 1 } }