Identity Center and attribute mapping for ABAC

I am trying to enable attribute-based access control (ABAC) using IAM Identity Center. However, I am a bit confused on how to setup attribute mapping in Identity Center. I wanted to used user's Department attribute for it, but I am still receiving Access Denied. I am using CDK in TypeScript and I have the following configuration for mapping.

new CfnInstanceAccessControlAttributeConfiguration(stack, 'attribute-config', {
    instanceArn: INSTANCE_ARN,
    accessControlAttributes: [
        {
            key: 'Department',
            value: {
                source: ['${path:enterprise.department}'],
            },
        },
    ],
});

Then I set up following permission set.

new CfnPermissionSet(stack, 'permission-set', {
    instanceArn: INSTANCE_ARN,
    name: 'MyPermisionSet',
    inlinePolicy: new PolicyDocument({
        statements: [
            new PolicyStatement({
                effect: Effect.ALLOW,
                actions: ['s3:ListAllMyBuckets'],
                resources: ['*'],
            }),
            new PolicyStatement({
                effect: Effect.ALLOW,
                actions: [
                    's3:ListBucket',
                    's3:GetBucket*',
                ],
                resources: ['*'],
                conditions: {
                    'StringEquals': {
                        'aws:ResourceTag/Department': '${aws:PrincipalTag/Department}',
                    },
                },
            }),
        ],
    }).toJSON(),
});

Finally, the objects are created such that

const devBucket = new Bucket(stack, 'DevBucket');
Tags.of(devBucket).add('Department', 'Dev');
const itBucket = new Bucket(stack, 'ItBucket');
Tags.of(itBucket).add('Department', 'IT');

I created user in Identity Center and assign the account and permission set to him (also set his Department). I can list the buckets, but I can't view objects in that bucket (I can view objects if I remove the condition from the permission set, so the condition must be the problem). I looked for the operation in CloudTrail, and the only session context attributes are

"attributes": {
   "creationDate": "2024-09-01T20:09:58Z",
   "mfaAuthenticated": "false"
}

Note that the access doesn't work even if I change the source to "${path:userName}" and change the bucket tag according to the username of the user. How can I enable such setup please?

I am probably confused of which values as source I can use. As far as I understand, I can use values according to the [Enterprise User Extension Representation](https://datatracker.ietf.org/doc/html/rfc7643#section-8.3] specification, but that applies only for SCIM. However, Supported user and group attributes in IAM Identity Center specifies these attribute as general that can be used with any directory (Identity Center directory, Microsoft AD directory, as well as external IdP). But then in Attribute mappings for AWS Managed Microsoft AD directory, only subset of them is mentioned. Moreover, some of them as path prefix, while others have dir or user. What is the difference and how I know which to use when? E.g. some examples use ${path:enterprse.department} source but in the RFC7643 there is urn:ietf:params:scim:schemas:extension:enterprise:2.0:User attribute. Can somebody please explain this or send me some relevant sources? I am a bit confused here.