Examkin

Question

Difficulty: MediumMulti-Account Identity and Access Management Federation

An enterprise is configuring federated single sign-on (SSO) for its systems administrators using PingFederate as an external SAML 2.0 Identity Provider (IdP). The administrators must be able to authenticate and access a shared development account in their AWS Organizations. You need to configure the trust relationship in AWS so that the PingFederate IdP can exchange SAML assertions for temporary AWS credentials.

Which of the following configuration steps must be performed in the target AWS account to successfully establish this federation? (Select TWO.)

  1. Create a SAML identity provider in IAM using the metadata document generated by PingFederate.Answer
  2. Create an IAM role with a trust policy that grants assume role permissions to the SAML provider ARN using the sts:AssumeRoleWithSAML action.Answer
  3. C
    Configure the IAM role trust policy to allow the sts:AssumeRole action for the federated PingFederate entity.
  4. D
    Attach a Service Control Policy (SCP) to the target account's Organization Unit (OU) that explicitly grants sts:AssumeRoleWithSAML access to the external identity provider.

Answer

To configure SAML 2.0 federation, you must create a SAML identity provider in IAM using the PingFederate metadata document, and create an IAM role with a trust policy that specifies the SAML provider as the principal and allows the sts:AssumeRoleWithSAML action.
To establish SAML federation, AWS IAM requires a SAML identity provider object containing the external provider's metadata, and an IAM role with a trust policy that specifically allows the action 'sts:AssumeRoleWithSAML' with the SAML provider as the principal.

Step-by-Step Solution

1
Download the SAML metadata document from PingFederate.
A metadata XML file containing the identity provider's configuration and certificates.
This document is required by AWS to establish a trust relationship with the PingFederate server.
2
Create the SAML identity provider in the target AWS account's IAM console or via the CLI using the metadata document.
An IAM SAML provider resource with an ARN representing the PingFederate IdP.
This establishes the trust relationship between AWS IAM and the external IdP.
3
Create an IAM role with a trust policy referencing the SAML provider's ARN as the Principal and specifying the action sts:AssumeRoleWithSAML.
An IAM role that federated users can assume upon successful authentication at the IdP.
This allows the PingFederate IdP to assume the role using SAML assertions and obtain temporary credentials.

Key Concept

Establishing trust for external SAML 2.0 Identity Providers (IdP) in AWS IAM using SAML metadata and IAM role trust policies.
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic