Examkin

Question

Difficulty: EasyMulti-Account Identity and Access Management Federation

A company is configuring identity federation using an external SAML 2.0 Identity Provider (IdP) to allow corporate users to log directly into a specific AWS member account. A Solutions Architect creates the SAML Identity Provider in IAM and defines an IAM role for the federated users. However, during testing, users receive an Access Denied error when attempting to assume the role via SAML assertion. Which configuration issue is the most likely cause of this error?

  1. A
    The Service Control Policy (SCP) at the root level of the organization has not been configured to explicitly grant the federated users permissions to assume the role.
  2. The trust policy of the IAM role specifies the action sts:AssumeRole instead of sts:AssumeRoleWithSAML for the SAML provider principal.Answer
  3. C
    The trust policy of the IAM role specifies sts:AssumeRoleWithWebIdentity as the allowed action for the SAML provider principal.
  4. D
    The SAML provider metadata has not been registered as an IAM user within the master account of the AWS Organization.

Answer

The trust policy of the IAM role specifies the action sts:AssumeRole instead of sts:AssumeRoleWithSAML for the SAML provider principal.
The correct answer is that the trust policy must use the sts:AssumeRoleWithSAML action for SAML-based identity federation. Using sts:AssumeRole is incorrect because it is only for standard cross-account or direct assume role requests using IAM credentials.

Step-by-Step Solution

1
Verify the Identity Provider configuration in the IAM console.
Confirm the SAML metadata document from the external IdP is successfully uploaded.
Ensure AWS can validate assertions sent from the IdP.
2
Inspect the trust relationship policy document of the target IAM role.
Locate the Action element and the Principal element in the policy.
To verify that the role designates the SAML provider as the trusted entity and permits the correct API call.
3
Change the Action element to sts:AssumeRoleWithSAML.
The federation flow completes successfully, granting the user temporary security credentials.
SAML assertion logins require the specialized sts:AssumeRoleWithSAML action rather than standard sts:AssumeRole.

Key Concept

SAML 2.0 Federation Trust Policy Configuration
Estimated Time:45s
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic