Examkin

Question

Difficulty: Very hardMulti-Account Identity and Access Management Federation

An enterprise manages its multi-account environment under AWS Organizations. The security team has attached a Service Control Policy (SCP) to the Production Organizational Unit (OU) to ensure that all API calls are blocked unless they originate from the corporate network egress IP range of 203.0.113.0/24203.0.113.0/24.

The enterprise uses an external SAML 2.0 compliant Identity Provider (IdP) for identity federation. A Solutions Architect is establishing federated access to a member account within the Production OU for database administrators who require administrative access to Amazon RDS resources. The SAML identity provider object has already been created in the member account.

The architect needs to configure an IAM role named `DBAdminRole` in the member account to allow these users to federate and perform their tasks.

Which configuration must the architect implement to ensure database administrators can successfully federate and manage RDS resources?

  1. A
    Configure the trust policy of the `DBAdminRole` with the federated SAML provider ARN as the principal and the `sts:AssumeRole` action. Rely on the Production OU SCP to grant the necessary Amazon RDS permissions to any user federating from 203.0.113.0/24203.0.113.0/24, as SCPs automatically authorize federated sessions within their scope.
  2. Configure the trust policy of the `DBAdminRole` with the federated SAML provider ARN as the principal and the `sts:AssumeRoleWithSAML` action. Attach a local IAM permissions policy to `DBAdminRole` that explicitly grants the required Amazon RDS permissions, as the SCP restricts the maximum permissions but does not grant them.Answer
  3. C
    Configure the trust policy of the `DBAdminRole` with the federated SAML provider ARN as the principal and the `sts:AssumeRoleWithWebIdentity` action. Attach a local IAM permissions policy to `DBAdminRole` that explicitly grants the required Amazon RDS permissions, and configure the Production OU SCP to explicitly allow `sts:AssumeRoleWithWebIdentity` to grant the federation privilege.
  4. D
    Configure the trust policy of the `DBAdminRole` with `arn:aws:iam::aws:policy/AdministratorAccess` as the principal and the `sts:AssumeRoleWithSAML` action. Leave the `DBAdminRole` permissions policy empty, since the Production OU SCP's lack of an explicit deny for the corporate network implicitly grants full RDS permissions to the federated session.

Answer

Configure the trust policy of the role with the federated SAML provider ARN as the principal and the `sts:AssumeRoleWithSAML` action, while attaching a local IAM permissions policy to the role that explicitly grants the required Amazon RDS permissions.
To set up SAML 2.0 federation, the IAM role trust policy must specify the `Federated` principal pointing to the SAML provider ARN and permit the `sts:AssumeRoleWithSAML` action. Furthermore, because Service Control Policies (SCPs) do not grant permissions but only act as filters, the role itself must have a local IAM permissions policy attached that explicitly grants the database administrators the necessary Amazon RDS access. This fulfills the security guardrails while ensuring the database administrators are granted the correct permissions.

Step-by-Step Solution

1
Identify the authentication protocol and the required STS action.
Since the enterprise uses SAML 2.0, the role trust policy must specify the action `sts:AssumeRoleWithSAML` and trust the IAM SAML provider ARN.
SAML 2.0 federation relies on the direct authentication of users via a SAML assertion exchanged for temporary security credentials using the `sts:AssumeRoleWithSAML` API.
2
Determine how permissions are granted in a multi-account environment governed by SCPs.
SCPs act as a filter (guardrail) and do not grant permissions. A local IAM policy must be attached to the role to grant the actual database administration permissions.
An implicit deny is the default state in AWS. Even if the SCP allows traffic from the corporate IP, an explicit Allow in the local IAM policy is still required to grant access.
3
Ensure the trust policy principal is correctly defined.
Define the `Principal` in the IAM role's trust policy as the ARN of the SAML provider created in the account.
Trust policies must specify the identity provider entity as a federated principal to authenticate incoming SAML assertions.

Key Concept

Interaction between IAM role trust policies, local permissions, and Service Control Policies (SCPs) in multi-account SAML federation.
Estimated Time:3m 0s
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic