Can we apply role to IDP users

From :- https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_ec2_tag-owner.html

If you want to provide EC2 start and stop permissions to users from an external Active Directory, you can follow these general steps:

1. Create an AWS SSO Permission Set:

   • In AWS SSO, create a permission set that includes the permissions (start and stop EC2 instances) you want to grant.

2. Assign Permission Set to Users:

   • Assign the permission set to the users from your external Active Directory. This association will grant them the specified permissions.

3. Create IAM Role with EC2 Permissions:

   • Create an IAM role with the desired EC2 permissions. This IAM role will be assumed by the EC2 instances when started or stopped.

4. Trust Relationship:

   • Modify the trust relationship of the IAM role to allow AWS SSO to assume the role on behalf of the users. The trust relationship might look something like this:

     {
       "Version": "2012-10-17",
       "Statement": [
         {
           "Effect": "Allow",
           "Principal": {
             "Federated": "arn:aws:iam::<ACCOUNT_ID>:sso.amazonaws.com"
           },
           "Action": "sts:AssumeRoleWithWebIdentity",
           "Condition": {
             "StringEquals": {
               "ssosso.amazonaws.com:aud": "app/<SSO_APP_ID>"
             }
           }
         }
       ]
     }

     Replace <ACCOUNT_ID> with your AWS account ID and