Examkin

Question

Difficulty: Very hardMulti-Account Identity and Access Management Federation

An enterprise is designing a multi-account access strategy for its workloads managed under AWS Organizations. The security team wants to implement Attribute-Based Access Control (ABAC) to restrict access to resources within member accounts. Enterprise users reside in an external SAML 2.0 Identity Provider (IdP). Users must federate directly to target IAM roles in member accounts and be authorized dynamically based on their department attribute. The department name must be passed as a session tag during federation. Which of the following configuration steps must be performed to meet these requirements? (Select TWO.)

  1. Configure the SAML Identity Provider to release the user's department attribute as a SAML attribute named `https://aws.amazon.com/SAML/Attributes/PrincipalTag:Department`.Answer
  2. In each target member account, configure the trust policy of the federated IAM role to allow both the `sts:AssumeRoleWithSAML` and `sts:TagSession` actions for the SAML identity provider principal.Answer
  3. C
    In each target member account, configure the trust policy of the federated IAM role to allow the `sts:AssumeRole` action, and attach a Service Control Policy (SCP) to the member accounts that grants `sts:TagSession` to the federated principal.
  4. D
    Configure the SAML Identity Provider to release the department attribute using the default namespace `urn:oasis:names:tc:SAML:2.0:attrname-format:uri`, and configure a Service Control Policy (SCP) at the root level to allow session tagging across accounts.
  5. E
    In each target member account, configure the federated IAM role trust policy to allow only the `sts:AssumeRoleWithSAML` action, and rely on an organizational Service Control Policy (SCP) to implicitly permit session tagging for the federated principal.

Answer

Configure the SAML Identity Provider to release the user's department attribute as a SAML attribute named with the PrincipalTag prefix, and configure the target federated IAM role trust policy to allow both the sts:AssumeRoleWithSAML and sts:TagSession actions.
To configure Attribute-Based Access Control (ABAC) using SAML federation, the SAML Identity Provider must send user attributes as session tags. This is achieved by naming the attribute in the SAML assertion with the prefix `https://aws.amazon.com/SAML/Attributes/PrincipalTag:Department`. Furthermore, the IAM role trust policy in the target accounts must explicitly allow both the `sts:AssumeRoleWithSAML` action (to perform the federation) and the `sts:TagSession` action (to allow the role to accept the incoming session tags).

Step-by-Step Solution

1
Configure the SAML Identity Provider (IdP) to release the department attribute as a session tag.
The SAML assertion contains a SAML attribute named `https://aws.amazon.com/SAML/Attributes/PrincipalTag:Department` containing the user's department.
AWS Security Token Service (STS) expects session tags to be prefixed with `https://aws.amazon.com/SAML/Attributes/PrincipalTag:` in the SAML assertion.
2
Configure the federated IAM role trust policy in the target member accounts to trust the central Identity Provider and allow session tagging.
The trust policy has its Principal set to the SAML provider ARN and allows both `sts:AssumeRoleWithSAML` and `sts:TagSession` actions.
The `sts:AssumeRoleWithSAML` action is required to authenticate SAML assertions, and the `sts:TagSession` action is required to authorize the ingestion of session tags during federation.
3
Define an ABAC authorization policy on resources inside the member accounts.
IAM policies evaluate access permissions by comparing the session tag `aws:PrincipalTag/Department` to the resource tag `Department`.
Once the session tags are ingested via SAML federation, they can be referenced in IAM policy conditions for fine-grained resource access control.

Key Concept

Multi-Account Identity and Access Management Federation using SAML session tags for Attribute-Based Access Control (ABAC).
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic