ロールベースのアクセス制御に Amazon Web Services Session Tags を使用する

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeInstances"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:StartInstances",
                "ec2:StopInstances"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "ec2:ResourceTag/CostCenter": "<%= "${aws:PrincipalTag/CostCenter}" %>"
                }
            }
        }
    ]
}

function(user, context, callback) {
  var awsAccount = '013823792818';
  var rolePrefix = `arn:aws:iam::` + awsAccount; 
  var samlIdP = rolePrefix + `:saml-provider/auth0SamlProvider`;

  user.awsRole = rolePrefix + `:role/AccessByCostCenter,` + samlIdP;
  user.awsRoleSession = user.email;
  user.awsTagKeys = ['CostCenter', 'Project'];
  user.CostCenter = 'marketing';
  user.Project = 'website';

  context.samlConfiguration.mappings = {
    'https://aws.amazon.com/SAML/Attributes/Role': 'awsRole',
    'https://aws.amazon.com/SAML/Attributes/RoleSessionName': 'awsRoleSession',
    'https://aws.amazon.com/SAML/Attributes/PrincipalTag:CostCenter': 'CostCenter',
    'https://aws.amazon.com/SAML/Attributes/PrincipalTag:Project': 'Project'
  };

  callback(null, user, context);
}