Examkin

Question

Difficulty: HardMulti-Account Identity and Access Management Federation

An enterprise is migrating a legacy customer portal application to a member account within its AWS Organizations structure. The application requires direct SAML 2.0 federation with an external identity provider (IdP) for client authentication because the application's legacy client does not support modern OpenID Connect (OIDC) or integration with AWS IAM Identity Center. A solutions architect must configure the trust relationships so that external users can successfully authenticate and assume a role named LegacyAppFederatedRole. Which of the following actions must the solutions architect take to meet these requirements? (Select TWO.)

  1. Create a SAML identity provider in the target AWS member account using the metadata document retrieved from the external identity provider.Answer
  2. Configure the trust policy of the IAM role in the member account to allow the sts:AssumeRoleWithSAML action, specifying the SAML identity provider as the principal.Answer
  3. C
    Configure the trust policy of the IAM role in the member account to allow the sts:AssumeRole action, specifying the SAML identity provider as the principal.
  4. D
    Attach a Service Control Policy (SCP) at the Organizational Unit level that grants sts:AssumeRoleWithSAML to all federated identities in the member account to bypass local IAM role configurations.
  5. E
    Configure the trust policy of the IAM role in the member account to allow the sts:AssumeRoleWithWebIdentity action for the SAML identity provider principal.

Answer

Create a SAML identity provider in the target AWS member account using the metadata document from the external identity provider, and configure the trust policy of the IAM role in the member account to allow the sts:AssumeRoleWithSAML action, specifying the SAML identity provider as the principal.
Establishing direct SAML 2.0 federation requires registering the identity provider in the destination member account's IAM. Once registered, the destination IAM role must trust that SAML provider using the sts:AssumeRoleWithSAML action in its trust policy, enabling external users to exchange their SAML assertion for AWS temporary credentials.

Step-by-Step Solution

1
Register the external identity provider in the AWS account.
A SAML 2.0 identity provider object is created in the member account's IAM using the metadata document from the external IdP.
This establishes trust between the member account and the external identity provider at the account level.
2
Create or update the target IAM role with a federated trust policy.
The IAM role trust policy is configured with the principal pointing to the SAML provider's ARN and the action allowed is set to sts:AssumeRoleWithSAML.
This configuration allows the Security Token Service (STS) to issue temporary credentials when the external identity provider asserts the user's identity.

Key Concept

SAML 2.0 Identity Federation in IAM
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic