本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。

# AWS IAM Identity Center Verified Access 信任資料的內容
<a name="trust-data-iam"></a>

評估政策時，如果您將 AWS IAM Identity Center 定義為信任提供者， AWS Verified Access 會在您指定為信任提供者組態上的「政策參考名稱」之金鑰下的 Cedar 內容中包含信任資料。您可以選擇撰寫評估信任資料的政策。

**注意**  
信任提供者的內容索引鍵來自您在建立信任提供者時設定的政策參考名稱。例如，如果您將政策參考名稱設定為 "idp123"，內容索引鍵將為 "context.idp123"。建立政策時，請檢查您使用的是正確的內容金鑰。

下列 [JSON 結構描述](https://json-schema.org/)顯示評估中包含哪些資料。

```
{
   "title": "AWS IAM Identity Center context specification",
   "type": "object",
   "properties": {
     "user": {
       "type": "object",
       "properties": {
         "user_id": {
           "type": "string",
           "description": "a unique user id generated by AWS IdC"
         },
         "user_name": {
           "type": "string",
           "description": "username provided in the directory"
         },
         "email": {
           "type": "object",
           "properties": {
             "address": {
               "type": "email",
               "description": "email address associated with the user"
             },
             "verified": {
               "type": "boolean",
               "description": "whether the email address has been verified by AWS IdC"
             }
           }
         }
       }
     },
     "groups": {
       "type": "object",
       "description": "A list of groups the user is a member of",
       "patternProperties": {
         "^[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}$": {
           "type": "object",
           "description": "The Group ID of the group",
           "properties": {
             "group_name": {
               "type": "string",
               "description": "The customer-provided name of the group"
             }
           }
         }
       }
     }
   }
 }
```

以下是針對 提供的信任資料進行評估的政策範例 AWS IAM Identity Center。

```
permit(principal, action, resource) when {
   context.idc.user.email.verified == true
   // User is in the "sales" group with specific ID
   && context.idc.groups has "c242c5b0-6081-1845-6fa8-6e0d9513c107"
 };
```

**注意**  
由於群組名稱可以變更，IAM Identity Center 會使用群組 ID 來參考群組。這有助於避免在變更群組名稱時中斷政策陳述式。