Examkin

Question

Difficulty: HardMulti-Account Identity and Access Management Federation

A logistics company is implementing a centralized identity strategy for its AWS multi-account environment. The company hosts its user directory in a third-party SAML 2.02.0 Identity Provider (IdP). To streamline administrative overhead, they want to establish direct console federation to target AWS member accounts. An administrator configures the SAML metadata in the member accounts and defines an IAM role named `LogisticsOperatorRole` for the users. However, when operators attempt to log in through the IdP portal, they are blocked with an authentication error. An analysis of the trust relationships reveals that the authentication handshake is failing at the Security Token Service (STS) endpoint. Which configuration must the administrator apply to the `LogisticsOperatorRole` trust policy to resolve this issue?

  1. A
    Set the trust policy's `Principal` to the ARN of the SAML provider created in the member account, set the `Action` to `sts:AssumeRole`, and add a `Condition` block that evaluates the `SAML:iss` context key to match the IdP entity ID.
  2. Set the trust policy's `Principal` to the ARN of the SAML provider created in the member account, set the `Action` to `sts:AssumeRoleWithSAML`, and add a `Condition` block that evaluates `SAML:aud` to match `https://signin.aws.amazon.com/saml`.Answer
  3. C
    Attach a Service Control Policy (SCP) to the member accounts' Organizational Unit that authorizes `sts:AssumeRoleWithSAML` for the external IdP's domain, which dynamically creates the temporary credentials without requiring an IAM role trust policy.
  4. D
    Set the trust policy's `Principal` to reference the IdP's metadata endpoint URL directly, set the `Action` to `sts:AssumeRoleWithWebIdentity`, and configure the policy to use the default AWS-managed KMS key (`aws/kms`) for decrypting the assertion token.

Answer

Configure the trust policy of the target IAM role to specify the SAML provider ARN as the principal, use the `sts:AssumeRoleWithSAML` action, and ensure the condition evaluates the SAML audience parameter against the standard AWS sign-in URL.
The correct configuration establishes a SAML federation model. The trust policy must trust the SAML provider ARN created in the member account, authorize the `sts:AssumeRoleWithSAML` action to allow authentication without pre-existing AWS credentials, and enforce a security condition where the SAML audience claim (`SAML:aud`) matches the AWS console sign-in URL.

Step-by-Step Solution

1
Identify the authentication protocol and API endpoint mismatch.
The company uses SAML 2.02.0, which requires the target IAM role trust policy to use the specialized API action `sts:AssumeRoleWithSAML` instead of standard `sts:AssumeRole` or `sts:AssumeRoleWithWebIdentity`.
Standard role assumption does not accept SAML assertions, and web identity federation is intended for OIDC providers.
2
Establish the trust relationship using the SAML provider metadata object.
The principal of the IAM trust policy must point to the SAML provider resource ARN that represents the IdP inside the AWS account.
This establishes trust between AWS IAM and the external Identity Provider metadata document.
3
Add the audience validation condition key.
Add a condition verifying that `SAML:aud` matches `https://signin.aws.amazon.com/saml`.
This guarantees that the token was explicitly issued for the AWS console login endpoint, preventing credential misuse.

Key Concept

SAML 2.0 Identity Federation Trust Policies
Estimated Time:2m 30s
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic