Examkin

Question

Difficulty: MediumMulti-Account Identity and Access Management Federation

A company implements a multi-account strategy using AWS Organizations. The IT security team wants to configure federation with an external SAML 2.0 Identity Provider (IdP) to allow users to authenticate and directly access resources in a shared services account and multiple production accounts. The solutions architect needs to create an IAM role in each AWS account that will be assumed by the federated users. Which configuration must the solutions architect apply to the trust relationship of the IAM roles to establish trust with the SAML IdP and ensure that only authenticated federated users from the company's IdP can assume these roles?

  1. A
    Create a SAML identity provider in the organization's management account. Configure the trust policy of the target IAM roles in each member account by setting the Principal to the management account's SAML provider and the Action to sts:AssumeRoleWithWebIdentity.
  2. B
    Attach a Service Control Policy (SCP) to the organization's root that allows access from the corporate SAML provider's identity URL, and configure the member account IAM roles to inherit this federated access without defining local trust policies.
  3. Create a SAML identity provider in each AWS account's IAM. Configure the trust policy of the target IAM roles in each account by setting the Principal to the ARN of the local SAML identity provider and the Action to sts:AssumeRoleWithSAML.Answer
  4. D
    Create a SAML identity provider in each AWS account's IAM. Configure the trust policy of the target IAM roles in each account by setting the Principal to the corporate Identity Provider's external metadata endpoint and the Action to sts:AssumeRole.

Answer

Create a SAML identity provider in each AWS account's IAM. Configure the trust policy of the target IAM roles in each account by setting the Principal to the ARN of the local SAML identity provider and the Action to sts:AssumeRoleWithSAML.
The correct configuration requires creating a SAML 2.0 identity provider object in each target AWS account where the federated roles reside. The trust policy of these roles must reference the ARN of the local SAML provider object as the federated Principal and specify the sts:AssumeRoleWithSAML action to allow authentication from the external identity provider.

Step-by-Step Solution

1
Create a SAML 2.0 identity provider (IdP) object in the IAM console of each AWS account where the federated users need access, uploading the XML metadata document provided by the corporate IdP.
A SAML provider resource is created in each account with a unique ARN (e.g., arn:aws:iam::<AccountID>:saml-provider/<ProviderName>).
AWS IAM requires a local representation of the external identity provider to establish trust and evaluate assertions.
2
Create or configure the IAM roles that the federated users will assume, specifying the local SAML provider's ARN as the federated principal in the trust policy.
The role's trust relationship is established with the local SAML provider resource.
This allows AWS STS to trust assertions signed by the configured external identity provider when attempting to assume this specific role.
3
Set the Action in the trust policy's statement to sts:AssumeRoleWithSAML and configure appropriate conditions such as mapping the SAML:aud attribute.
The role trust policy is complete and validates SAML assertion exchanges.
The sts:AssumeRoleWithSAML action is the specific AWS Security Token Service (STS) API call required to exchange SAML assertions for temporary AWS credentials.

Key Concept

Multi-Account SAML 2.0 Federation configuration using AWS IAM and AWS STS
Estimated Time:2m 0s
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic