CLI Command/API to Show Current Session's Tags and Attributes

Question

I have multiple AWS accounts setup with Identity Center and an external SAML provider.

The specific use-case I have is that I have permission sets which are synced across accounts and within these accounts, I need to grant tailored access to specific users to be able to auth to RDS over IAM. If I were only supporting a single shared RDS IAM user, [writing a policy granting access would be trivial](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.IAMPolicy.html), but because I need to grant access to specific RDS IAM users based on _who the user behind the assumed role is_, I need a further level of granularity on things, and for this, I need to use context keys in my policy.

I am aware of [global session context keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html) and I'm aware that [SAML session tags exist](https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_abac-saml.html), but what I'm currently looking for is a CLI or API for showing all of the associated tags/attributes on the current session that I'm using.

I can obviously get the account id, role ARN, and user id by using `aws sts get-caller-identity`, but is there a command that I can execute which will actually describe all of the tags/attributes assigned to the current session? I need something that can do this so I can understand what I'm operating with as I draft my IAM policy.

re:Post Agent · Answer

To view all the tags and attributes associated with your current AWS session, you can use the AWS CLI command `aws sts get-session-tag` or the API equivalent `GetSessionTag`. This will show you all the session tags that have been applied to your current role session.

For a more comprehensive view of your session context, including both session tags and other session attributes, you can use the AWS CLI command `aws sts get-caller-identity` combined with `aws iam get-user` or `aws iam get-role` depending on your identity type.

When working with IAM database authentication for RDS, you'll need to understand which context keys are available to use in your policies. For tailoring access based on who the user behind the assumed role is, you can use context keys like `${aws:username}` in your policy conditions.

For example, in an RDS resource policy, you could use a condition like:
```
"Condition": {
"StringEqualsIgnoreCase": {"rds:db-tag/Owner": "${aws:username}"}
}
```

This would allow users to only access RDS resources that they have tagged with their username as the "Owner" value.

When implementing least privilege access, remember that explicit deny statements always take precedence over allow statements in IAM policies. This is important to consider when designing your permission structure across multiple accounts.

If you're having trouble determining which session attributes are available, you might need to examine the SAML assertion that's being passed from your identity provider, as this contains the attributes that get mapped to session tags.  
**Sources**  
[Amazon RDS: Allows tag owners full access to RDS resources that they have tagged - AWS Identity and Access Management](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_rds_tag-owner.html)  
[ClientError: An error occurred (AccessDeniedException) when calling the CreateInferenceComponent operation: | AWS re:Post](https://repost.aws/questions/QUCVyA17ynTWGawZujBdayqg/clienterror-an-error-occurred-accessdeniedexception-when-calling-the-createinferencecomponent-operation)  
[Identity-based policy examples for Amazon RDS - Amazon Relational Database Service](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_id-based-policy-examples.html)

CLI Command/API to Show Current Session's Tags and Attributes

Add your answer

Relevant content