An ecommerce company is building an AWS Control Tower landing zone and has configured the identity source in AWS IAM Identity Center (AWS SSO) to use an external SAML 2.0 IdP. The DevOps team wants a least-privilege permission model so each team can create and manage only its own resources. Which combination of actions will satisfy these requirements? (Choose three.)

To achieve least privilege with an external IdP in AWS Control Tower, you should first create groups in your external IdP, add users to these groups, and then assign these groups to specific accounts and permission sets within IAM Identity Center. This establishes the user-to-permission mapping. Next, enable attributes for access control in IAM Identity Center and map relevant attributes from your IdP as key-value pairs. These mapped attributes become principal tags. Finally, create permission sets with inline policies that grant the necessary permissions and use the aws:PrincipalTag condition key to restrict resource access based on these tags. This ensures users can only manage resources tagged with their team's identifier. Creating IAM policies with aws:PrincipalTag directly isn't sufficient without permission sets and IdP mapping. Assigning groups to OUs and IAM policies isn't the correct mechanism for Identity Center. Tagging users directly in Identity Center is not how attributes from an external IdP are typically used for access control; mapping IdP attributes is the correct approach.