Examkin

Question

Difficulty: MediumMulti-Account Identity and Access Management Federation

A financial company is designing a multi-account environment on AWS and wants to federate identities from their on-premises Active Directory Federation Services (ADFS) to allow developers to access resources in a dedicated Development account. A solutions architect configures ADFS as a SAML Identity Provider (IdP) in the Development account. The architect now needs to configure an IAM role that developers can assume upon successful authentication. Which of the following trust policies should be attached to this IAM role to allow ADFS users to assume it?

  1. An IAM trust policy that sets the 'Federated' principal to the ARN of the SAML provider, specifies the 'sts:AssumeRoleWithSAML' action, and includes a condition verifying the 'SAML:aud' attribute matches the AWS SAML endpoint.Answer
  2. B
    An IAM trust policy that sets the principal to the ADFS provider ARN, specifies the standard 'sts:AssumeRole' action, and relies on an identity-based policy attached directly to the SAML provider.
  3. C
    A Service Control Policy (SCP) applied at the Organizational Unit level that explicitly allows 'sts:AssumeRoleWithSAML', thereby granting access without requiring a local trust policy on the role.
  4. D
    An IAM resource-based policy on the SAML provider entity that delegates access to the development role, utilizing the 'sts:AssumeRole' action for user redirection.

Answer

An IAM trust policy that sets the 'Federated' principal to the ARN of the SAML provider, specifies the 'sts:AssumeRoleWithSAML' action, and includes a condition verifying the 'SAML:aud' attribute matches the AWS SAML endpoint.
The correct answer provides the precise configurations required for SAML federation in an IAM trust policy. The trust policy must trust the SAML provider as a federated entity, invoke the 'sts:AssumeRoleWithSAML' action to assume the role using SAML assertions, and validate the target audience endpoint via 'SAML:aud' to prevent spoofing or security misconfigurations.

Step-by-Step Solution

1
Identify the type of identity federation being configured.
The identity source is ADFS using SAML 2.0 federation.
Choosing the correct Security Token Service (STS) action requires knowing whether the protocol is SAML, OIDC, or standard IAM.
2
Determine the required Principal and Action for the IAM role trust policy.
Principal must be 'Federated' pointing to the SAML provider ARN, and Action must be 'sts:AssumeRoleWithSAML'.
AWS STS requires 'sts:AssumeRoleWithSAML' to exchange SAML assertions for temporary credentials.
3
Define the validation condition for the SAML assertion.
Add a condition that checks 'SAML:aud' matches 'https://signin.aws.amazon.com/saml'.
This prevents credentials from being issued if the assertion was intended for a different audience or service.

Key Concept

SAML 2.0 IAM Role Trust Policy Setup
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic