---
title: Configuring AWS session tags for PingFederate SAML connections
description: You can configure AWS Identity and Access Management (IAM) and AWS IAM Identity Center session tag support for SAML connections in PingFederate.
component: amazon
page_id: amazon:amazon_web_services_session_tags_integrations_guide:pf_awssessiontags_integration_configuring_aws_session_tags_for_pf_saml_connections
canonical_url: https://docs.pingidentity.com/integrations/amazon/amazon_web_services_session_tags_integrations_guide/pf_awssessiontags_integration_configuring_aws_session_tags_for_pf_saml_connections.html
llms_txt: https://docs.pingidentity.com/integrations/amazon/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: July 3, 2024
section_ids:
  before-you-begin: Before you begin
  steps: Steps
  choose-from: Choose from:
  result: Result
---

# Configuring AWS session tags for PingFederate SAML connections

You can configure AWS Identity and Access Management (IAM) and AWS IAM Identity Center session tag support for SAML connections in PingFederate.

## Before you begin

* If you want to use OGNL expressions to populate the values of the AWS session tags, see [Enabling and disabling expressions](https://docs.pingidentity.com/pingfederate/latest/administrators_reference_guide/pf_enable_disable_express.html) in the PingFederate documentation.

* Create an Amazon Web Services (AWS) console account and policy that uses session tags. For help, see [AWS prerequisites (page 241)](https://cdn-docs.pingidentity.com/archive/pdf/pingaccess/pingaccess-52.pdf#page=242) in the PingAccess documentation.

## Steps

1. Open your service provider (SP) connection. Go to **SP Connection > Browser SSO > Assertion Creation > Attribute Contract**.

2. Extend the contract of the AWS SP connection.

   ### Choose from:

   * If you are using AWS SSO, include the access control tags based on the following format:

     * `https://aws.amazon.com/SAML/Attributes/AccessControl:{attribute}`

       ![This screen capture shows the Attribute Contract tab with several example AWS SSO access control attributes.](_images/qld1605284905064.jpg)

   * If you are using AWS IAM, include the AWS Principal Tags and TransitiveTagKeys, based on the following examples:

     * `https://aws.amazon.com/SAML/Attributes/AccessControl:{attribute}`

     * `https://aws.amazon.com/SAML/Attributes/PrincipalTag:project`

     * `https://aws.amazon.com/SAML/Attributes/Role`

     * `https://aws.amazon.com/SAML/Attributes/RoleSessioName`

     * `https://aws.amazon.com/SAML/Attributes/TransitiveTagKeys`

   ![This screen capture shows the Attribute Contract tab with the example AWS IAM PrincipalTag and TransitiveTagKeys attributes.](_images/kwg1571947883022.png)

3. Go to **SP Connection > Browser SSO > Assertion Creation > IdP Adapter Mapping > Attribute Sources & User Lookup > Attribute Contract Fulfillment**.

4. Configure the attribute contract fulfillment for the AWS attributes.

   Example 1: This example shows AWS IAM Identity Center attributes mapped directly from an HTML Form Adapter instance.

   ![This screen capture shows the Attribute Contract Fulfillment tab with AWS IAM Identity Center attributes mapped to Adapter sources.](_images/jmq1605288110796.jpg)

   Example 2: This example shows AWS IAM attributes mapped from a data source and manipulated by the OGNL expression language available in PingFederate.

   ![This screen capture shows the Attribute Contract Fulfillment tab with AWS IAM attributes mapped to Adapter and LDAP sources.](_images/vaw1571948042845.png)

5. Click **Save**.

## Result

The AWS session tags are now included in the SAML assertion created by PingFederate.