Examkin

Question

Difficulty: MediumMulti-Account Identity and Access Management Federation

An enterprise manages its multi-account AWS environment using AWS Organizations. The enterprise federates user identities from an external SAML 2.0-compliant identity provider (IdP). To enforce fine-grained access control across accounts, the solutions architect needs to implement Attribute-Based Access Control (ABAC) using the user's Department attribute defined in the IdP. The SAML assertion is already configured to send the department name. Which configuration must the solutions architect apply to the IAM roles in the target accounts to support this identity federation and access control model?

  1. A
    Configure the IAM role trust policy to trust the SAML IdP, and allow both the sts:AssumeRole and sts:TagSession actions. Use the aws:RequestTag/Department condition key in the role's policies to validate the user's department.
  2. Configure the IAM role trust policy to trust the SAML IdP, and allow both the sts:AssumeRoleWithSAML and sts:TagSession actions. Use the aws:PrincipalTag/Department condition key in the role's policies to permit access to resources with matching tags.Answer
  3. C
    Configure the IAM role trust policy to trust the SAML IdP and allow the sts:AssumeRoleWithSAML action. Use the saml:Attributes/Department condition key in the role's policies to restrict resource access.
  4. D
    Configure a Service Control Policy (SCP) at the Organizational Unit (OU) level to propagate the SAML assertion's Department attribute as a session tag. Allow the sts:AssumeRoleWithSAML action in the target IAM role's trust policy.

Answer

Configure the IAM role trust policy to trust the SAML IdP, and allow both the sts:AssumeRoleWithSAML and sts:TagSession actions. Use the aws:PrincipalTag/Department condition key in the role's policies to permit access to resources with matching tags.
The correct option is correct because implementing ABAC with SAML federation requires the SAML assertion to pass the attributes as session tags. For AWS to accept and apply these attributes as principal tags, the IAM role's trust policy must explicitly allow the sts:AssumeRoleWithSAML action to authorize federation and the sts:TagSession action to permit session tagging. Once trusted, these tags can be referenced globally in IAM policies using the aws:PrincipalTag/Department condition key.

Step-by-Step Solution

1
Ensure the external SAML identity provider (IdP) is configured to send the user's department attribute mapped to the AWS-defined SAML attribute name prefix for principal tags.
The SAML assertion will contain the Department value in the format required for AWS session tagging.
AWS requires federated attributes intended for session tags to be formatted correctly in the SAML assertion.
2
Modify the target IAM role's trust policy in the target AWS accounts to allow the sts:AssumeRoleWithSAML action for authentication and the sts:TagSession action for passing attributes as tags.
The IAM role is authorized to federate users and map the incoming SAML attributes as transient session tags (principal tags).
Without sts:TagSession authorized in the trust policy, any session tags passed in the SAML assertion will be rejected by AWS Security Token Service (STS).
3
Reference the department attribute using the aws:PrincipalTag/Department condition key in the target role's IAM policies to restrict resource access to matching tags.
The IAM policies will dynamically evaluate access based on the department tag associated with the federated session.
Using aws:PrincipalTag/Department enables Attribute-Based Access Control (ABAC) by comparing the federated session tag with resource tags.

Key Concept

To implement Attribute-Based Access Control (ABAC) using external SAML federation in a multi-account setup, the IAM role trust policy must allow both the sts:AssumeRoleWithSAML action (for authentication) and the sts:TagSession action (to accept federated attributes as principal tags). The tags can then be evaluated dynamically using the aws:PrincipalTag condition key in authorization policies.
Estimated Time:2m 0s
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic