A logistics enterprise is deploying a multi-account AWS environment and wants to federate access for its administrative operations team using an external OpenID Connect (OIDC) identity provider. The administrators need to assume specific roles to access resources across multiple target member accounts. The solutions architect must configure OIDC federation directly with AWS IAM for these member accounts. Which of the following configuration steps are required to establish this trust relationship? (Select TWO.)
- In each target member account, create an IAM OpenID Connect (OIDC) identity provider that points to the external identity provider.Answer
- In each target member account, create an IAM role with a trust policy that specifies the OIDC identity provider as the principal and allows the sts:AssumeRoleWithWebIdentity action.Answer
- CIn each target member account, create an IAM role with a trust policy that specifies the OIDC identity provider as the principal and allows the sts:AssumeRole action.
- DIn the AWS Organizations management account, create a Service Control Policy (SCP) that allows the sts:AssumeRoleWithWebIdentity action for the OIDC provider and attach it to the target member accounts.
Answer
To establish trust with an external OpenID Connect (OIDC) identity provider, you must create an IAM OIDC identity provider in the target member accounts and configure IAM roles with a trust policy allowing the sts:AssumeRoleWithWebIdentity action.
Establishing OIDC federation requires registering the OIDC provider in the IAM configuration of the member accounts and defining IAM roles with trust policies that specifically authorize the sts:AssumeRoleWithWebIdentity API action. This allows users authenticated by the external IdP to assume the roles.
Step-by-Step Solution
Key Concept
OpenID Connect (OIDC) Federation Configuration