Exam AWS DevOps Engineer Professional topic 1 question 175 discussion

A company has multiple AWS accounts. The company uses AWS Single Sign-On (AWS SSO) that is integrated with AWS Toolkit for Microsoft Azure DevOps. The attributes for access control feature is enabled in AWS SSO.

The attribute mapping list contains two entries. The department key is mapped to ${path:enterprise.department}. The costCenter key is mapped to ${path:enterprise.costCenter}.

All existing Amazon EC2 instances have a department tag that corresponds to three company departments (d1, d2, d3). A DevOps engineer must create policies based on the matching attributes. The policies must minimize administrative effort and must grant each Azure AD user access to only the EC2 instances that are tagged with the user's respective department name.

Which condition key should the DevOps engineer include in the custom permissions policies to meet these requirements?