本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

# AWS IAM Identity Center 已验证访问信任数据的上下文
<a name="trust-data-iam"></a>

在评估策略时，如果您定义 AWS IAM Identity Center 为信任提供者，则会将 Cedar 上下文中的信任数据 AWS Verified Access 包含在信任提供者配置中指定为 “策略参考名称” 的密钥下。如果您愿意，可以编写根据信任数据进行评估的策略。

**注意**  
您的信任提供商的上下文键来自您在创建该信任提供商时配置的策略参考名称。例如，如果您将策略参考名称配置为“idp123”，则上下文键将为“context.idp123”。创建策略时，请检查是否正在使用正确的上下文键。

以下 [JSON 架构](https://json-schema.org/)显示了评估中包含的数据。

```
{
   "title": "AWS IAM Identity Center context specification",
   "type": "object",
   "properties": {
     "user": {
       "type": "object",
       "properties": {
         "user_id": {
           "type": "string",
           "description": "a unique user id generated by AWS IdC"
         },
         "user_name": {
           "type": "string",
           "description": "username provided in the directory"
         },
         "email": {
           "type": "object",
           "properties": {
             "address": {
               "type": "email",
               "description": "email address associated with the user"
             },
             "verified": {
               "type": "boolean",
               "description": "whether the email address has been verified by AWS IdC"
             }
           }
         }
       }
     },
     "groups": {
       "type": "object",
       "description": "A list of groups the user is a member of",
       "patternProperties": {
         "^[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}$": {
           "type": "object",
           "description": "The Group ID of the group",
           "properties": {
             "group_name": {
               "type": "string",
               "description": "The customer-provided name of the group"
             }
           }
         }
       }
     }
   }
 }
```

以下是根据 AWS IAM Identity Center提供的信任数据进行评估的策略示例。

```
permit(principal, action, resource) when {
   context.idc.user.email.verified == true
   // User is in the "sales" group with specific ID
   && context.idc.groups has "c242c5b0-6081-1845-6fa8-6e0d9513c107"
 };
```

**注意**  
由于组名称可以更改，因此 IAM Identity Center 使用组 ID 来引用组。这有助于避免在更改组名称时违反策略声明。