Examkin

Question

Difficulty: MediumMulti-Account Identity and Access Management Federation

An organization is setting up federated single sign-on (SSO) to allow on-premises directory users to access the AWS Management Console across multiple member accounts in an AWS Organization. The solution must use a third-party SAML 2.0 Identity Provider (IdP). Which two configuration steps must be performed in each target AWS member account to establish this federation? (Select TWO.)

  1. Create an IAM SAML identity provider in each target member account using the XML metadata document from the on-premises IdP.Answer
  2. Create an IAM role in each target member account with a trust policy that defines the SAML provider as the principal and allows the sts:AssumeRoleWithSAML action.Answer
  3. C
    Create an IAM role in each target member account with a trust policy that defines the SAML provider as the principal and allows the sts:AssumeRole action.
  4. D
    Apply a Service Control Policy (SCP) at the Organizational Unit level that explicitly grants the sts:AssumeRoleWithSAML permission to the federated users.
  5. E
    Create an IAM user in each target member account with a trust policy that grants the sts:AssumeRoleWithSAML permission to the on-premises IdP.

Answer

To establish SAML 2.0 federation, each target member account must have an IAM SAML identity provider created using the IdP's metadata document, and an IAM role with a trust policy allowing the federated principal to assume the role via the sts:AssumeRoleWithSAML action.
Establishing SAML 2.0 federation with AWS requires two primary configurations in each target member account: first, creating an IAM SAML identity provider using the metadata document from the IdP to establish the trust boundary; second, creating an IAM role with a trust policy that targets the SAML provider ARN as the principal and allows the sts:AssumeRoleWithSAML action. This allows the SAML assertion to be exchanged for temporary AWS security credentials.

Step-by-Step Solution

1
Generate the SAML metadata document from the on-premises Identity Provider (IdP) containing the entity ID, public keys, and redirect URLs.
The metadata XML file is ready to be imported into AWS.
AWS requires this document to establish trust and verify SAML assertions signed by the IdP.
2
Create an IAM SAML identity provider in each target AWS member account and upload the metadata XML document.
An IAM SAML provider entity is created with a unique ARN.
This establishes the identity provider within the local scope of each target AWS account.
3
Create an IAM role in each target account with a trust policy designating the newly created SAML provider ARN as the principal, specifying the sts:AssumeRoleWithSAML action, and evaluating the SAML:aud condition.
An IAM role is created that can be assumed by federated users.
This links the authenticated SAML assertions to specific permissions inside the AWS account.

Key Concept

Establishing SAML 2.0 federation trust relationships in multi-account environments.
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic