IAM Identity Center user variable

Question

Is there a way to associate a variable value, i.e. key pair, with an individual IAM Identity Center user?

The situation I am trying to resolve is to give each individual IAM Identity Center user the ability to update their personal IP address in the security group that controls access to our bastion host. Restricting to the Security Group is easy enough, but I want to limit users to modifying only their particular Security Group Rule. To do this I need to associate a particular sgr- value with each user which is then used as part of a resource ARN.

Ibrahim Cesar · Answer

Yes, there is a way to associate variable values like key pairs with individual IAM Identity Center users.

When you create permission sets in IAM Identity Center, you can define variables that will be available to the IAM policies assigned to users through those permission sets. For example, you could define a variable called ${sso:user} that contains the username of the authenticated user. [1]

Then in your IAM policies, you can reference this variable to customize the resources a user has access to based on their identity. For the scenario you described, you could create a policy that allows modifying security group rules where the rule ID contains the ${sso:user} variable.

For example:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "ec2:AuthorizeSecurityGroupIngress", 
      "Resource": "arn:aws:ec2:*:*:security-group-rule/sgr-${sso:user}",
      "Effect": "Allow"
    }
  ]
}
```

This would allow each IAM Identity Center user to only modify rules associated with their own username. The key is defining variables in your permission sets that are then available to customize access in IAM policies. Let me know if any part needs variables in your permission sets that are then available to customize access in IAM policies.  Let me know if any part needs more explanation! [2]

**Sources**

[1] Limit IAM Identity Center Users to defined Region | AWS re:Post
repost.awsquestionsQU5wjaO6vZR7Kx7SUULYYjrwlimit-iam-identity-center-users-to-defined-region

[2] Identity-based policy examples for IAM Identity Center - AWS IAM Identity Center
docs.aws.amazon.comsinglesignonlatestiam-auth-access-using-id-policies.html

IAM Identity Center user variable

Relevant content