Examkin

Question

Difficulty: EasyMulti-Account Identity and Access Management Federation

A company is setting up identity federation with an external SAML 2.0 Identity Provider (IdP) to allow corporate users to access the AWS Management Console of a member account. A solutions architect needs to configure the trust relationship in the target member account.

Which configuration steps must the solutions architect perform in the target AWS account to establish this federated access? (Select TWO.)

  1. Create an IAM SAML identity provider in the target AWS account using the metadata document from the corporate Identity Provider.Answer
  2. Create an IAM role in the target AWS account with a trust policy that allows the sts:AssumeRoleWithSAML action for the SAML provider.Answer
  3. C
    Create a Service Control Policy (SCP) at the Organization level that explicitly grants sts:AssumeRoleWithSAML permissions to all federated identities.
  4. D
    Create an IAM role in the target AWS account with a trust policy that allows the sts:AssumeRole action for the root user of the account.
  5. E
    Create an IAM group in the target AWS account, attach the corporate identity provider to it, and add the federated users to the group.

Answer

Create an IAM SAML identity provider in the target AWS account using the metadata document from the corporate Identity Provider, and create an IAM role in the target AWS account with a trust policy that allows the sts:AssumeRoleWithSAML action for the SAML provider.
Establishing federated access requires creating a SAML identity provider in IAM using the metadata document from the corporate identity provider, which allows AWS to trust the provider. Additionally, an IAM role with a trust policy permitting the sts:AssumeRoleWithSAML action must be created so that users authenticated by the SAML provider can assume the role and gain access to resources.

Step-by-Step Solution

1
Register the external Identity Provider in the AWS target account.
An IAM SAML identity provider is created representing the corporate IdP.
This establishes trust between the target AWS account and the external SAML identity provider.
2
Define an IAM role to map corporate users.
An IAM role is created with a trust policy granting sts:AssumeRoleWithSAML to the newly created SAML identity provider.
This allows federated users authenticated by the IdP to temporarily assume permissions in the target account.

Key Concept

Establishing SAML 2.0 identity federation in a multi-account environment requires creating a local SAML identity provider object and configuring an IAM role with a trust policy allowing the sts:AssumeRoleWithSAML action.
Estimated Time:1m 0s
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic