Examkin

Question

Difficulty: HardMulti-Account Identity and Access Management Federation

A multinational retail company is designing a federated authentication solution for its multi-account AWS environment managed via AWS Organizations. The company utilizes an external SAML 2.0 compliant Identity Provider (IdP) for identity management. The solutions architect needs to establish federated single sign-on (SSO) so that corporate employees can access resources in various AWS member accounts according to their corporate group memberships. The security team mandates that identity federation must be established directly using IAM SAML identity providers in the member accounts, without deploying AWS IAM Identity Center. Which of the following configuration steps must the solutions architect perform to successfully set up this federation? (Select TWO.)

  1. Create a SAML identity provider entity in each AWS member account by uploading the XML metadata document obtained from the corporate Identity Provider.Answer
  2. In each AWS member account, create IAM roles containing a trust policy that lists the SAML provider as the principal and allows the sts:AssumeRoleWithSAML action.Answer
  3. C
    In each AWS member account, create IAM roles containing a trust policy that lists the SAML provider as the principal and allows the sts:AssumeRole action.
  4. D
    Configure a Service Control Policy (SCP) at the root level of the AWS Organization that automatically delegates identity provider trust down to all member accounts, eliminating the need to create local SAML provider entities.

Answer

Creating a SAML identity provider entity in each member account with the corporate metadata, and creating local IAM roles in those accounts with trust policies allowing the sts:AssumeRoleWithSAML action.
Establishing SAML-based federation directly to member accounts requires creating a SAML provider entity in each target account using the IdP's metadata XML document, and configuring IAM roles in those accounts that grant trust to the SAML provider using the sts:AssumeRoleWithSAML action.

Step-by-Step Solution

1
Establish trust on the AWS side by creating a SAML 2.0 Identity Provider (IdP) in each AWS member account.
Each member account recognizes the corporate IdP as a trusted issuer of assertions.
Before users can federate into an account, AWS must be configured to trust the external provider.
2
Create target IAM roles in the member accounts with a trust policy pointing to the SAML provider ARN.
The roles are configured with trust policies allowing the sts:AssumeRoleWithSAML action.
The correct API action for SAML-based federation is sts:AssumeRoleWithSAML, which evaluates the SAML assertion claims before returning temporary credentials.
3
Configure the corporate IdP to send the correct SAML attributes, mapping the users to the appropriate AWS role and provider ARNs.
The corporate IdP sends the Role and RoleSessionName attributes in the SAML assertion.
AWS relies on specific SAML attributes in the assertion to determine which role the user is authorized to assume.

Key Concept

SAML 2.0 Federation Trust Configuration in Multi-Account Environments
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic