Examkin

Question

Difficulty: MediumMulti-Account Identity and Access Management Federation

A financial services firm is establishing a federated identity mechanism across their AWS Organizations environment. Users stored in an on-premises Active Directory must authenticate via an external SAML 2.0 identity provider to manage resources within individual target AWS accounts.

To set up direct federation with the target accounts without using AWS IAM Identity Center, which configuration steps must a solutions architect implement in each target AWS account? (Select TWO.)

  1. Create a SAML identity provider resource in IAM using the XML metadata document obtained from the external identity provider.Answer
  2. Create an IAM role with a trust policy that allows the 'sts:AssumeRoleWithSAML' action for the SAML identity provider principal and contains a condition mapping the audience ('SAML:aud') to the AWS SAML endpoint.Answer
  3. C
    Attach a Service Control Policy (SCP) at the Root level of the organization that allows the 'sts:AssumeRoleWithSAML' action for the external identity provider ARN.
  4. D
    Configure an IAM role in each account with a trust policy that allows 'sts:AssumeRole' as the action and defines the external identity provider's SAML entity as the principal.
  5. E
    Configure AWS Resource Access Manager (RAM) in the management account to share a single centralized SAML identity provider resource with all member accounts in the organization.

Answer

Create a SAML identity provider resource in IAM using the XML metadata document from the external identity provider, and create an IAM role with a trust policy that allows the 'sts:AssumeRoleWithSAML' action for the SAML identity provider principal and contains a condition mapping the audience ('SAML:aud') to the AWS SAML endpoint.
To configure direct SAML 2.0 federation with AWS accounts, the solutions architect must first establish trust by creating a SAML identity provider resource in the target account using the IdP's metadata XML. Once the provider is established, an IAM role must be configured with a trust policy that trusts the SAML provider principal and specifies the 'sts:AssumeRoleWithSAML' action. This trust policy should also contain a condition that evaluates the SAML audience ('SAML:aud') to match the AWS sign-in endpoint, ensuring that the token was intended for AWS console access.

Step-by-Step Solution

1
Create the SAML identity provider in AWS IAM for each target account.
An IAM SAML provider entity is created using the XML metadata document from the external identity provider.
This establishes the cryptographic trust boundary between AWS and the external Identity Provider.
2
Configure the IAM role and its trust policy.
An IAM role is created with a trust policy mapping the SAML provider ARN as the principal and granting the 'sts:AssumeRoleWithSAML' action.
This allows users authenticated by the SAML provider to assume the role and obtain temporary security credentials.

Key Concept

Establishing trust and configuring IAM roles for SAML 2.0 federation in a multi-account environment.
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic