Examkin

Question

Difficulty: HardMulti-Account Identity and Access Management Federation

A financial analytics firm uses AWS Organizations to manage 100 member accounts grouped under a single Production Organizational Unit (OU). The firm wants to implement single sign-on (SSO) using its on-premises SAML 2.0-compliant Identity Provider (IdP). The Solutions Architect must establish federation to grant a group of data analysts read-only access to specific Amazon S3 buckets located across the member accounts. A Service Control Policy (SCP) is applied at the Production OU level to prevent any modification of S3 buckets and objects. Federated users must assume an IAM role in each member account to perform their duties. Which of the following configuration steps must the Solutions Architect perform to successfully establish the federation and ensure the analysts have the necessary access? (Select TWO.)

  1. In each member account, configure the trust policy of the IAM role with the local SAML provider as the Principal, and set the Action to sts:AssumeRoleWithSAML with a Condition checking the SAML:aud attribute.Answer
  2. In each member account, attach an IAM permission policy to the federated IAM role that explicitly allows the required S3 read actions, ensuring the policy does not exceed the boundaries set by the OU-level SCP.Answer
  3. C
    In each member account, configure the trust policy of the IAM role with the external Identity Provider as the Principal, and set the Action to sts:AssumeRole to allow federation tokens to be exchanged.
  4. D
    Rely on the SCP attached at the Organizational Unit (OU) level to grant the S3 read-only permissions to the federated users, without attaching an IAM permission policy to the role in the member accounts.
  5. E
    Configure the external Identity Provider as an OpenID Connect (OIDC) provider in the management account, and set the Action in the member account trust policies to sts:AssumeRoleWithWebIdentity.

Answer

Establish SAML-based federation by configuring the IAM role trust policy in each member account to use the local SAML provider as the principal and allow the sts:AssumeRoleWithSAML action, and attach local IAM permission policies to the roles to grant S3 read access, since the organizational Service Control Policy (SCP) only acts as a filter and does not grant permissions directly.
To successfully federate with an external SAML 2.0 Identity Provider (IdP) in a multi-account setup, each member account must have a local SAML identity provider created, and the IAM role's trust policy must specify the local SAML provider as the principal and use the sts:AssumeRoleWithSAML action. Furthermore, because Service Control Policies (SCPs) act as permission boundaries and do not grant permissions directly, the federated IAM roles in the member accounts must have explicit local IAM permission policies attached that grant the required S3 read permissions.

Step-by-Step Solution

1
Configure the trust relationship for the IAM role in each member account.
The trust policy is updated to specify the local SAML Identity Provider as the principal and allow the sts:AssumeRoleWithSAML action.
This is required to allow the on-premises Identity Provider to authenticate users and assume the specified role in the member account via SAML token exchange.
2
Attach a local IAM permissions policy to the IAM role in the member accounts.
The IAM role has a policy that explicitly allows the required S3 read actions.
SCPs only restrict permissions and do not grant them. A local IAM policy is necessary to explicitly grant the permissions to the role principal.

Key Concept

Multi-Account SAML Federation and Service Control Policy interaction
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic