Examkin

Question

Difficulty: HardMulti-Account Identity and Access Management Federation

A financial services organization is establishing a federated identity solution to allow corporate directory users to log in directly to 100+ AWS member accounts within an AWS Organization. The company is using an on-premises SAML 2.0 compliant Identity Provider (IdP). The Solutions Architect must configure the environment to map corporate group memberships to specific IAM roles in each member account while ensuring federated access is secure and follows AWS best practices. Which of the following actions must the Solutions Architect take to successfully establish this federation? (Select TWO.)

  1. Create a SAML Identity Provider entity in each member account and configure IAM roles with a trust policy that specifies the sts:AssumeRoleWithSAML action and references the SAML provider ARN as the Principal.Answer
  2. Configure the external IdP to send SAML assertions containing the https://aws.amazon.com/SAML/Attributes/Role attribute populated with the ARN of the IAM role and the ARN of the SAML provider, along with the RoleSessionName attribute.Answer
  3. C
    Create a single centralized SAML Identity Provider in the AWS Organizations management account and attach a Service Control Policy (SCP) to the root organizational unit to propagate the trust relationship to all member accounts.
  4. D
    Configure IAM roles in the member accounts with a trust policy that allows the sts:AssumeRole action and specifies the external IdP's metadata URL in the Principal element.

Answer

To configure direct SAML 2.0 federation, the Solutions Architect must create a SAML Identity Provider in each member account and configure IAM roles with a trust policy allowing the sts:AssumeRoleWithSAML action. Additionally, the external IdP must be configured to pass the Role and RoleSessionName attributes in the SAML assertion.
Establishing a trust relationship with a SAML 2.0 IdP requires defining a SAML identity provider within each member account that users need to access. Roles in these accounts must trust this provider using the sts:AssumeRoleWithSAML action. The external IdP must also send the AWS-specific SAML attributes (Role and RoleSessionName) to allow AWS to validate and map the incoming assertion to the correct IAM role.

Step-by-Step Solution

1
Establish trust in member accounts
Create a SAML identity provider in each AWS member account using the IdP's XML metadata document.
This allows each individual account to recognize and trust assertions signed by the corporate Identity Provider.
2
Create target IAM roles and define trust policies
Configure IAM roles in the member accounts with a trust policy that permits the sts:AssumeRoleWithSAML action and designates the local SAML provider ARN as the Principal.
This enables federated users to assume these roles when presenting valid assertions from the trusted provider.
3
Configure SAML assertions at the IdP
Configure the IdP to map user attributes to AWS-specific SAML attributes, specifically Role (combining role and provider ARNs) and RoleSessionName.
These attributes are required by the AWS sign-in endpoint to determine which role to assume and how to identify the user session.

Key Concept

Direct SAML 2.0 federation to multiple AWS accounts requires a local SAML identity provider, a trust policy utilizing sts:AssumeRoleWithSAML, and the mapping of required AWS SAML attributes at the IdP.
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic