Examkin

Question

Difficulty: MediumMulti-Account Identity and Access Management Federation

An organization has configured a multi-account AWS environment using AWS Organizations. They federate their corporate active directory identity provider (IdP) with AWS accounts using SAML 2.0. Users authenticate through the corporate portal and are redirected to the AWS Console, but they receive an error stating that they are not authorized to perform the sts:AssumeRoleWithSAML action. A solutions architect examines the target IAM role in the member account. Which configuration in the IAM role's trust policy is required to resolve this issue?

  1. The trust policy must define the SAML Provider ARN as the Principal, specify the sts:AssumeRoleWithSAML action, and include a condition verifying that the SAML:aud attribute matches the AWS SAML endpoint.Answer
  2. B
    The trust policy must define the root account of the AWS Organization as the Principal, specify the sts:AssumeRole action, and rely on an organization-level Service Control Policy (SCP) to map corporate group names.
  3. C
    The trust policy must define the SAML Provider ARN as the Principal, specify the sts:AssumeRole action, and include a condition checking that the SAML subject matches the user's corporate email address.
  4. D
    The trust policy must define the Web Identity Provider ARN as the Principal, specify the sts:AssumeRoleWithWebIdentity action, and include a condition verifying the OAuth application ID.

Answer

The trust policy must define the SAML Provider ARN as the Principal, specify the sts:AssumeRoleWithSAML action, and include a condition verifying that the SAML:aud attribute matches the AWS SAML endpoint.
The correct option outlines the required structure for a SAML 2.0 trust policy. The principal must point to the SAML provider ARN, the action must be sts:AssumeRoleWithSAML, and the condition must validate that the SAML:aud attribute matches the AWS SAML sign-in endpoint (https://signin.aws.amazon.com/saml).

Step-by-Step Solution

1
Identify the authentication protocol being used in the scenario.
The authentication protocol is SAML 2.0 federated with an active directory identity provider (IdP).
Choosing the correct trust policy parameters depends on whether the federation uses SAML 2.0 or OpenID Connect (OIDC).
2
Determine the required API action and principal type for SAML 2.0 federation.
The API action must be sts:AssumeRoleWithSAML, and the principal must be the ARN of the SAML provider resource created in IAM.
AWS STS requires the specific AssumeRoleWithSAML action when resolving SAML assertions, and the trust policy must explicitly trust the SAML IdP metadata document imported as an IAM provider.
3
Verify standard trust policy condition blocks for security.
The condition block should verify that the SAML:aud attribute matches 'https://signin.aws.amazon.com/saml'.
This condition ensures that the SAML assertion is intended specifically for AWS sign-in services, preventing man-in-the-middle or replay attacks.

Key Concept

SAML 2.0 Identity Provider Federation and IAM Trust Policies
Estimated Time:1m 30s
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic