AWS Organization SSO and RCP

To enforce access only via SAML federation from AWS Identity Center, you can apply a Condition in your IAM roles’ trust policy using the aws:SourceIdentity or sts:ExternalId context keys — but Identity Center doesn't directly use ExternalId. Instead, the safer and more scalable option is:

Step-by-Step: Use IAM Role Trust Policy with SAML Principal:

json Copy Edit { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Federated": "arn:aws:iam::<YOUR_ACCOUNT_ID>:saml-provider/<PROVIDER_NAME>" }, "Action": "sts:AssumeRoleWithSAML", "Condition": { "StringEquals": { "SAML:aud": "https://signin.aws.amazon.com/saml" } } } ] } Ensure the SAML Provider is tied to Identity Center. AWS Identity Center automatically manages the SAML identity provider behind the scenes, so any roles attached to Identity Center should use the correct trust policy like above.

Avoid Allowing AssumeRole or STS Direct Calls: Do not attach additional policies or trust relationships that allow plain sts:AssumeRole — this ensures users can't bypass SAML and must go through Identity Center login flow.

Pro Tip: Use Permission Sets in Identity Center, and assign them to users/groups. Identity Center manages the IAM roles and SAML conditions automatically.

You don’t need to manually build a root-level “RCP” — AWS Identity Center already creates and attaches correct policies unless you’re customizing federated flows across accounts.

Final Note: If you’re working in a multi-account Org, use Account Assignments in Identity Center + Permission Sets and you’ll stay within the proper AssumeRoleWithSAML boundary.

Let me know if you want help generating a JSON policy for one of your accounts!