Examkin

Question

Difficulty: EasyMulti-Account Identity and Access Management Federation

A company's security team is setting up identity federation to allow corporate users to access the AWS Management Console of a member account. The users will authenticate using an external SAML 2.0 Identity Provider (IdP). An IAM SAML identity provider entity has been created in the target AWS account. The solutions architect now needs to configure the trust policy of the IAM role that the federated users will assume. Which configuration must be specified in the trust policy to allow users authenticated by the SAML IdP to assume this role?

  1. Set the Principal to the Amazon Resource Name (ARN) of the SAML provider entity, and set the Action to sts:AssumeRoleWithSAML.Answer
  2. B
    Set the Principal to the Amazon Resource Name (ARN) of the SAML provider entity, and set the Action to sts:AssumeRole.
  3. C
    Configure a Service Control Policy (SCP) at the Organizational Unit level that allows sts:AssumeRoleWithSAML, assuming it will automatically delegate the permission to the role's trust policy.
  4. D
    Set the Principal to the AWS account ID of the AWS Organizations management account, and set the Action to sts:AssumeRoleWithWebIdentity.

Answer

Set the Principal to the Amazon Resource Name (ARN) of the SAML provider entity, and set the Action to sts:AssumeRoleWithSAML.
To establish federated access using SAML 2.0, the target IAM role's trust policy must trust the IAM SAML identity provider entity. This is configured by specifying the SAML provider's ARN in the Principal block and authorizing the sts:AssumeRoleWithSAML action.

Step-by-Step Solution

1
Identify the authentication standard being used.
SAML 2.0 federation is specified.
Choosing the correct AWS Security Token Service (STS) API action requires matching the federation protocol, which is SAML 2.0 in this scenario.
2
Determine the required Security Token Service (STS) action for SAML 2.0.
The correct action is sts:AssumeRoleWithSAML.
Unlike standard IAM cross-account access which uses sts:AssumeRole, federated access via SAML 2.0 requires the specific sts:AssumeRoleWithSAML action.
3
Identify the proper principal to trust in the policy.
The principal must be the IAM SAML identity provider entity ARN.
To establish trust with the external IdP, the trust policy must reference the IAM SAML provider resource rather than a standard AWS account ID.

Key Concept

SAML 2.0 identity federation trust policy configuration
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic