Examkin

Question

Difficulty: MediumMulti-Account Identity and Access Management Federation

A global retail company is designing a multi-account AWS environment managed under AWS Organizations. The company wants to enable federated single sign-on (SSO) for its systems administrators. The administrators must authenticate using the company's existing on-premises SAML 2.0 compliant Identity Provider (IdP) to directly access and manage resources in individual member accounts. Which two of the following configuration steps must be performed in each AWS member account to establish this federation?

  1. Create a SAML identity provider entity in each AWS member account using the XML metadata document exported from the corporate identity provider.Answer
  2. Create an IAM role in each AWS member account with a trust policy that allows the sts:AssumeRoleWithSAML action and designates the local SAML identity provider as the principal.Answer
  3. C
    Configure a trust policy for the IAM roles in the member accounts using sts:AssumeRoleWithWebIdentity as the action, targeting the corporate SAML 2.0 provider as the principal.
  4. D
    Attach a Service Control Policy (SCP) to the Organizational Unit containing the member accounts that explicitly allows the sts:AssumeRoleWithSAML action to grant the federated users administrative access.
  5. E
    Create a single SAML identity provider in the AWS Organizations management account and configure the IAM role trust policies in the member accounts to reference the management account's SAML provider Amazon Resource Name (ARN).

Answer

To establish direct SAML federation to each AWS member account, you must create a SAML identity provider entity in each member account using the corporate IdP metadata and configure an IAM role in each member account with a trust policy permitting the sts:AssumeRoleWithSAML action for that provider.
To configure direct SAML 2.0 federation for member accounts, you must establish trust in each account by creating a SAML identity provider using the IdP's metadata. Then, you must create an IAM role in each account whose trust policy permits the sts:AssumeRoleWithSAML action, allowing the external provider to exchange SAML tokens for temporary credentials.

Step-by-Step Solution

1
Register the Identity Provider in the AWS accounts.
A local IAM SAML identity provider is created in each target member account.
AWS needs to establish a trust relationship with the external SAML 2.0 IdP using its public keys and metadata.
2
Define the IAM roles for federated access.
An IAM role is created with the necessary permissions for administrators.
Federated users must assume a role to perform actions; the role maps SAML attributes to AWS permissions.
3
Configure the trust relationship on the IAM roles.
The role's trust policy allows the sts:AssumeRoleWithSAML action with the local SAML provider as the principal.
This configuration allows AWS STS to authenticate the SAML assertions and return temporary credentials.

Key Concept

Multi-Account SAML 2.0 Federation Setup
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic