Examkin

Question

Difficulty: EasyMulti-Account Identity and Access Management Federation

A company is configuring federated single sign-on (SSO) to multiple target AWS accounts using an on-premises SAML 2.0 Identity Provider (IdP). To enable corporate users to authenticate and access the target accounts, an administrator must create IAM roles in each target account. Which action must be included in the trust policy of these IAM roles to allow users to assume them via the SAML Identity Provider?

  1. A
    Specify the sts:AssumeRole action, listing the corporate domain names as the trusted principals.
  2. B
    Attach a Service Control Policy (SCP) at the root of the AWS Organization to authorize the sts:AssumeRole action for the external corporate network.
  3. Specify the sts:AssumeRoleWithSAML action, listing the SAML provider as the trusted principal.Answer
  4. D
    Specify the sts:AssumeRoleWithWebIdentity action, listing the corporate Active Directory domain controllers as the trusted web identity providers.

Answer

Specify the sts:AssumeRoleWithSAML action, listing the SAML provider as the trusted principal.
For SAML 2.0 federation, target IAM roles require a trust policy that permits the Security Token Service (STS) action sts:AssumeRoleWithSAML. The trust policy must specify the SAML Identity Provider as the principal to allow users authenticated by the IdP to obtain temporary AWS security credentials.

Step-by-Step Solution

1
Identify the authentication protocol used by the corporate Identity Provider.
The company is using SAML 2.0.
This determines which Security Token Service (STS) assume role action is appropriate.
2
Select the correct STS API action for SAML 2.0 federation.
The correct action is sts:AssumeRoleWithSAML.
This API operation returns a set of temporary security credentials for users authenticated by a SAML provider.
3
Configure the trust relationship policy document for the IAM role.
The IAM role trust policy is configured with sts:AssumeRoleWithSAML as the action and the SAML provider's ARN as the Principal.
This allows the SAML Identity Provider to trust and assume the IAM role.

Key Concept

SAML 2.0 Federation Trust Policy Action
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic