Examkin

Question

Difficulty: HardSecurity and Compliance Control Design

An enterprise is designing a secure federated identity access strategy for its multi-account environment managed by AWS Organizations. The identity team is integrating an on-premises SAML 2.0 compliant Identity Provider (IdP) with target IAM roles in various member accounts. To meet regulatory compliance, the solutions architect must enforce the following security controls:
1. Federated users accessing roles in production accounts must have successfully completed a multi-factor authentication (MFA) challenge at the IdP.
2. No local IAM users or IAM access keys may be created or utilized within any member accounts in the organization.

Which combination of actions must the solutions architect take to implement these compliance controls? (Select TWO.)

  1. Configure the trust policy of the IAM roles in the production accounts to trust the SAML provider principal with the sts:AssumeRoleWithSAML action, and add a condition that evaluates the SAML:AuthnContextClassRef attribute to ensure it matches the multi-factor authentication context class from the Identity Provider.Answer
  2. Create a Service Control Policy (SCP) that denies the iam:CreateUser and iam:CreateAccessKey actions, and attach this SCP to the root of the AWS Organization.Answer
  3. C
    Configure the trust policy of the IAM roles in the production accounts to trust the SAML provider with the sts:AssumeRole action, and attach an IAM policy to the roles that denies access when the global condition key aws:MultiFactorAuthPresent is set to false.
  4. D
    Create a Service Control Policy (SCP) that explicitly grants federated access to the target roles in the production accounts when authentication is successful, relying on the SCP inheritance to grant permissions without local IAM policies in the member accounts.
  5. E
    Configure the trust policy of the IAM roles to trust the SAML provider with the sts:AssumeRoleWithWebIdentity action, and modify the key policy of the default AWS-managed KMS key (aws/s3) in the member accounts to allow the SAML provider principal to decrypt session context.

Answer

The solutions architect must configure the trust policies of the target IAM roles to allow sts:AssumeRoleWithSAML and check the SAML:AuthnContextClassRef attribute for the MFA context. Additionally, the architect must create and attach an SCP at the root of the organization that denies the creation of IAM users and access keys.
The correct options state that the trust policy must use the sts:AssumeRoleWithSAML action and evaluate the SAML:AuthnContextClassRef attribute to enforce MFA, and that a Service Control Policy (SCP) denying iam:CreateUser and iam:CreateAccessKey must be attached to the root of the organization. Because SAML federated users authenticate via an external IdP rather than AWS directly, the native aws:MultiFactorAuthPresent condition key is not populated, requiring the use of the SAML assertion attribute instead. Additionally, SCPs are the standard mechanism to enforce global restrictions such as blocking IAM user and key creation in member accounts.

Step-by-Step Solution

1
Configure SAML federation trust relationship.
Create trust policies for the production IAM roles trusting the SAML provider principal with the sts:AssumeRoleWithSAML action.
This establishes the identity federation channel with the on-premises IdP.
2
Enforce MFA for federated sessions.
Evaluate the SAML:AuthnContextClassRef attribute in the IAM trust policy condition block.
Since the aws:MultiFactorAuthPresent condition key is only valid for AWS-managed MFA, SAML assertions must be verified using the AuthnContextClassRef attribute.
3
Implement governance guardrails against local IAM accounts.
Apply an SCP that denies the iam:CreateUser and iam:CreateAccessKey actions to the organization root.
SCPs act as maximum permission boundaries, ensuring that member accounts cannot create local IAM resources.

Key Concept

Enforcing security compliance controls through IAM federated role trust policies and organizational Service Control Policies (SCPs).
Estimated Time:3m 0s
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic