Examkin

Question

Difficulty: MediumMulti-Account Identity and Access Management Federation

An enterprise is configuring federated access to their multi-account AWS environment using an external SAML 2.0 Identity Provider (IdP). The identity team wants to allow users to authenticate through the IdP and assume specific IAM roles in multiple target AWS accounts managed under AWS Organizations. The solutions architect needs to configure the trust relationships and identity provider configurations.

Which TWO configurations must the solutions architect implement to establish this trust and allow users to federate directly into the target accounts? (Select TWO.)

  1. Create a SAML identity provider entity in each target AWS account pointing to the external IdP's metadata document.Answer
  2. Configure the trust policy of the IAM roles in the target accounts to allow the sts:AssumeRoleWithSAML action for the target SAML provider ARN.Answer
  3. C
    Configure the trust policy of the IAM roles in the target accounts with the sts:AssumeRole action and specify the external SAML provider as the principal.
  4. D
    Attach a Service Control Policy (SCP) at the root of the AWS Organization that explicitly grants sts:AssumeRoleWithSAML access to the external IdP's entity.
  5. E
    Create a single central SAML identity provider entity in the organization's management account and configure target account roles to trust the management account's provider using sts:AssumeRole.

Answer

To establish direct SAML federation, the solutions architect must create a SAML identity provider entity in each target AWS account pointing to the external IdP's metadata document, and configure the trust policy of the IAM roles in the target accounts to allow the sts:AssumeRoleWithSAML action for the target SAML provider ARN.
Direct SAML 2.0 federation requires the target AWS accounts to trust the external IdP. To establish this, a SAML identity provider entity must be created in each target AWS account. The target IAM roles must also have trust policies allowing the federated users to assume them via the sts:AssumeRoleWithSAML action using the specific provider ARN.

Step-by-Step Solution

1
Register the SAML Identity Provider (IdP) metadata with AWS IAM in each target account.
A unique SAML identity provider ARN is generated in each target AWS account, establishing a trusted configuration between that account and the external IdP.
AWS Security Token Service (STS) requires a registered provider entity within the target account to authenticate federated tokens locally.
2
Update the trust policy of the target IAM roles to specify the registered SAML provider ARN as the Principal and allow the sts:AssumeRoleWithSAML action.
The target IAM roles are authorized to accept SAML assertions matching the provider's trust metadata.
This establishes the trust relationship, allowing STS to issue temporary credentials when the external IdP issues a valid assertion.

Key Concept

Direct SAML 2.0 federation in a multi-account environment requires both a registered SAML identity provider entity in every target AWS account and target IAM role trust policies configured to allow the sts:AssumeRoleWithSAML action referencing the specific provider ARN.
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic