Policy variable for IAM Identity Center user

Question

Hi there,

I used the following statement to allow IAM users to terminate their own ssm sessions.

```
{
  "Effect": "Allow",
  "Action": "ssm:TerminateSession",
  "Resource": "arn:aws:ssm:*:*:session/${aws:username}-*"
}
```

How can I achieve the same result for IAM Identity Center users? The problem is for these users, I can't find the correct policy variable to use in Resource element.

Thank you.

Didier Durand · Answer

Hi,

My understanding (but I couldn't try....) is that a IAM Identity Center user is in Category `FederatedUser` for the table `Principal key values` in page https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_variables.html

In that case, `aws:username` is not present but `aws:userid` is valued with `account:caller-specified-name`

Please, try and let us know!

Best,

Didier

kritical · Answer

When working with AWS IAM Identity Center (formerly AWS SSO), you can still achieve the desired policy configuration for allowing users to terminate their own SSM sessions. However, instead of using `${aws:username}`, you'll use a different policy variable that represents the Identity Center user.

AWS provides a few IAM policy variables specific to Identity Center, such as `${aws:userid}`, `${aws:sub}`, and `${aws:principalTag/*}`. Among these, `${aws:userid}` can often be used effectively to represent the Identity Center user.

Here’s how you can modify your policy to allow IAM Identity Center users to terminate their own SSM sessions:

```
{
  "Effect": "Allow",
  "Action": "ssm:TerminateSession",
  "Resource": "arn:aws:ssm:*:*:session/${aws:userid}-*"
}
```
In this policy:

- `${aws:userid}` will be replaced with the unique identifier of the Identity Center user.
- The `ssm:TerminateSession` action is allowed on resources that match the ARN pattern `arn:aws:ssm:*:*:session/${aws:userid}-*`.

This approach would require that the users have the `username` tag correctly set in their Identity Center attributes.

By utilizing the correct policy variables, you can effectively manage permissions for IAM Identity Center users similarly to traditional IAM users.

Policy variable for IAM Identity Center user

Add your answer

Relevant content