Examkin

Question

Difficulty: MediumMulti-Account Identity and Access Management Federation

A company is setting up identity federation to allow corporate directory users to access resources across multiple member accounts in an AWS Organization. The company is using an external SAML 2.0 Identity Provider (IdP) for user authentication. The solutions architect needs to configure the trust relationship between the external IdP and the target AWS member accounts to allow authenticated users to assume specific IAM roles. Which of the following actions must be taken to successfully configure this trust relationship? (Select TWO.)

  1. Create an IAM SAML identity provider entity in each target AWS member account using the SAML metadata document obtained from the corporate IdP.Answer
  2. Configure the trust policy of each IAM role in the member accounts to allow the sts:AssumeRoleWithSAML action, specifying the SAML identity provider ARN as the principal.Answer
  3. C
    Configure the trust policy of each IAM role in the member accounts to allow the sts:AssumeRole action, specifying the SAML identity provider ARN as the principal.
  4. D
    Attach a Service Control Policy (SCP) to the target Organizational Units (OUs) that grants the sts:AssumeRoleWithSAML permission directly to the corporate users.
  5. E
    Enable IAM role chaining by configuring the target member account roles to trust the AWS Organizations management account root user principal.

Answer

Create an IAM SAML identity provider entity in each target AWS member account using the SAML metadata document obtained from the corporate IdP, and configure the trust policy of each IAM role in the member accounts to allow the sts:AssumeRoleWithSAML action, specifying the SAML identity provider ARN as the principal.
To establish federation trust with an external SAML IdP in a multi-account environment, you must create a SAML identity provider entity in each target account using the IdP's metadata. Then, you configure the trust policy of each target IAM role to allow the sts:AssumeRoleWithSAML action, specifying the SAML identity provider ARN as the trusted principal. This enables users authenticated by the external IdP to assume the target roles in the member accounts.

Step-by-Step Solution

1
Obtain the SAML metadata document from the external Identity Provider (IdP).
An XML metadata document that describes the IdP's entity ID, keys, and endpoints is ready for import.
This metadata is necessary to configure the trust relationship in AWS.
2
Create an IAM SAML identity provider in each target AWS account.
An IAM SAML provider resource is created with a unique ARN.
This establishes the identity provider within the scope of each AWS member account.
3
Create IAM roles in the member accounts with a trust policy configured for SAML.
IAM roles are configured with a trust policy that allows sts:AssumeRoleWithSAML for the SAML provider principal.
This allows federated users authenticated by the external IdP to assume these roles and obtain temporary credentials.

Key Concept

SAML 2.0 Federation Trust Configuration
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic