Ravi Sir's Cards › AWS
Federated identities and tags
This revision card explains Federated identities and tags. It starts from the need that ${aws:username} may be empty for some federated sessions. It describes prefer ${aws:userid} or aws:PrincipalTag/tenant for IdP users. The how-to section notes map IdP claims to session tags; test both IAM user and federated paths. An example on the card is rahul Deshmukh switches SSO users to PrincipalTag home folders.
Read card text
What this card says
Why do we need it?
${aws:username} may be empty for some federated sessions.
What is it?
Prefer ${aws:userid} or aws:PrincipalTag/tenant for IdP users.
PrincipalTag
How to do it
Map IdP claims to session tags; test both IAM user and federated paths.
Example
Rahul Deshmukh switches SSO users to PrincipalTag home folders.