Examkin

Question

Difficulty: MediumMulti-Account Identity and Access Management Federation

A company is implementing direct identity federation from an on-premises SAML 2.0-compliant Identity Provider (IdP) to multiple target AWS accounts in their AWS Organization. The Solutions Architect needs to set up the trust relationships so that corporate users can assume roles in these target accounts. Which of the following configuration steps must be performed in each target AWS account to successfully establish this trust? (Select TWO.)

  1. Create an IAM identity provider in the target AWS account by uploading the SAML metadata document obtained from the on-premises IdP.Answer
  2. Create an IAM role in the target AWS account with a trust policy that allows the sts:AssumeRoleWithSAML action for the SAML identity provider principal.Answer
  3. C
    Create an IAM role in the target AWS account with a trust policy that allows the sts:AssumeRole action for the SAML identity provider principal.
  4. D
    Attach a Service Control Policy (SCP) to the target accounts' Organizational Unit (OU) that grants the required IAM permissions directly to the IdP users.

Answer

To configure direct federation, you must create an IAM SAML identity provider in each target account using the IdP's metadata document, and create an IAM role with a trust policy permitting the sts:AssumeRoleWithSAML action.
Establishing direct SAML 2.0 federation requires creating an IAM SAML identity provider in each target AWS account using the IdP's metadata document. Additionally, an IAM role must be created in each target account with a trust policy that allows the sts:AssumeRoleWithSAML action for the SAML provider principal. This enables users authenticated by the on-premises IdP to safely assume the role and obtain temporary AWS credentials.

Step-by-Step Solution

1
Register the SAML Identity Provider in the AWS Account
An IAM SAML identity provider entity is created inside the target account.
This establishes the cryptographic trust from the target AWS account to the external Identity Provider by utilizing its metadata document.
2
Create the Federated IAM Role
An IAM role configured with a trust policy for the SAML provider is created.
The role must have a trust policy that explicitly allows the sts:AssumeRoleWithSAML action for the newly created SAML identity provider principal to allow federated users to obtain temporary security credentials.

Key Concept

Direct SAML 2.0 Federation Configuration in AWS Multi-Account Environments
Estimated Time:2m 0s
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic