Orbit Media uses Azure AD as an external identity provider with AWS IAM Identity Center. They want to implement ABAC so users can access only resources matching their costCenter. Which actions are REQUIRED to achieve this? (Choose two.)

To implement ABAC with AWS IAM Identity Center and Azure AD, two key steps are required. First, you must configure IAM Identity Center to map the costCenter attribute from Azure AD to a session tag and enable the option to make these attributes available in AWS as session tags. This ensures that the costCenter information from the user's identity provider is passed into the AWS session. Second, you need to define IAM policies within the permission set that utilize aws:PrincipalTag/costCenter conditions. These policies will restrict access to AWS resources that have a matching costCenter tag, thereby enforcing attribute-based access control. Incorrect options: Attaching a resource-based policy to IAM Identity Center is not the mechanism for trusting Azure AD or passing attribute context; that's handled by the identity source configuration within IAM Identity Center. Enabling ABAC organization-wide in AWS Organizations is not a prerequisite for tags to propagate from the IdP to sessions; the mapping in IAM Identity Center handles this. SAML 1.1 is not the only supported version; AWS IAM Identity Center supports SAML 2.0, which is standard for IdP integrations.