enforcing the role session name as principal tag

role-session-name-is-principal-tag.txt

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowAssumeRoleIfSessionNameEqualsAccessProjectSessionTagValue",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:RoleSessionName": "${aws:PrincipalTag/access-project}-${aws:PrincipalTag/access-team}",
          "aws:RequestTag/access-project": "${aws:PrincipalTag/access-project}",
          "aws:RequestTag/access-team": "${aws:PrincipalTag/access-team}"
        }
      }
    },
    {
      "Sid": "AllowPassSessionTagsAndTransitive",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:root"
      },
      "Action": "sts:TagSession",
      "Condition": {
        "StringLike": {
          "aws:RequestTag/access-project": "*",
          "aws:RequestTag/access-team": "*"
        },
        "ForAllValues:StringEquals": {
          "sts:TransitiveTagKeys": [
            "access-project",
            "access-team"
          ]
        }
      }
    }
  ]
}