A case-management app grants access when the caller’s PrincipalTag Department equals department tags on case-folder resources. Which authorization model is this?
Select an answer to reveal the explanation.
Short Explanation
ABAC is the matching-sticker rule: department tag on the badge must match department tag on the case folder. That scales cleaner than minting a unique access key per drawer. Public-read and AdministratorAccess are not attribute-based control.
Full Explanation
Attribute-based access control (ABAC) uses principal attributes (such as aws:PrincipalTag/Department) compared with resource tags via IAM condition keys to authorize access at scale. It avoids proliferating distinct policies per folder when tags carry the distinguishing attribute. Public reads and blanket AdministratorAccess do not implement tag-based authorization.