Examkin

Question

Difficulty: MediumMulti-Account Identity and Access Management Federation

A financial services organization is setting up federated access for external compliance auditors using an on-premises SAML 2.02.0 Identity Provider (IdP). The auditors must be allowed to assume a read-only role named `ComplianceAuditorRole` directly in a target member account (111122223333111122223333).

Which configuration steps must be performed in the target member account to establish this trust and enable successful federation? (Select TWO.)

  1. Create a SAML Identity Provider entity in the target member account using the XML metadata document exported from the on-premises Identity Provider.Answer
  2. Configure the trust policy of the target IAM role with the Principal set to the ARN of the created SAML Identity Provider and the Action set to `sts:AssumeRoleWithSAML`.Answer
  3. C
    Attach a Service Control Policy (SCP) to the target member account's Organizational Unit (OU) that defines the SAML Identity Provider as a resource and allows the `sts:AssumeRole` action.
  4. D
    Update the trust policy of the target IAM role to use the `sts:AssumeRole` action, and add a condition that validates the `SAML:aud` attribute matches the AWS SAML endpoint.

Answer

Creating a SAML Identity Provider entity in the target member account using the XML metadata document, and configuring the target IAM role's trust policy with the SAML provider as the Principal and `sts:AssumeRoleWithSAML` as the Action.
To configure SAML 2.02.0 federation for a specific member account, a SAML identity provider must be created in that member account using the IdP's metadata document. Additionally, the trust policy of the target IAM role must set the principal to that SAML provider and allow the `sts:AssumeRoleWithSAML` action.

Step-by-Step Solution

1
Export the SAML metadata document from the on-premises Identity Provider and use it to create a SAML Identity Provider entity in the target member account (111122223333111122223333).
AWS IAM establishes a trust anchor for the external IdP, allowing it to verify incoming assertions.
AWS needs the IdP's metadata (including certificate keys) to verify the signatures of incoming SAML assertions.
2
Update the trust policy of the target IAM role to reference the newly created SAML Identity Provider.
The target IAM role allows federated users from the specific SAML IdP to assume it.
The trust policy must explicitly allow the `sts:AssumeRoleWithSAML` action and identify the SAML provider ARN as the trusted principal.

Key Concept

Establishing trust for SAML 2.0 federation inside an AWS member account
Estimated Time:2m 0s
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic