Examkin

Question

Difficulty: MediumMulti-Account Identity and Access Management Federation

A company is implementing a multi-account identity strategy using AWS Organizations. They use an external SAML 2.0 compliant Identity Provider (IdP) to authenticate corporate users. The security team wants to enable single sign-on (SSO) so that administrators can access resources in a newly created member account. The administrators must assume a specific IAM role named NetworkAdminRole in the member account after authenticating via the IdP. Which of the following actions must the Solutions Architect perform to correctly configure the trust relationship for this federated access? (Select TWO.)

  1. Create an IAM SAML identity provider in the member account using the XML metadata document from the corporate Identity Provider.Answer
  2. Configure the trust policy of the NetworkAdminRole in the member account to define the Principal as the ARN of the SAML identity provider in the member account and specify the Action as sts:AssumeRoleWithSAML.Answer
  3. C
    Create the IAM SAML identity provider in the organization's management account, and configure the trust policy of the NetworkAdminRole in the member account to reference the management account's SAML provider ARN.
  4. D
    Configure the trust policy of the NetworkAdminRole in the member account to define the Principal as the member account's root user and specify the Action as sts:AssumeRole.
  5. E
    Attach a Service Control Policy (SCP) to the member account's Organizational Unit (OU) that explicitly grants the sts:AssumeRoleWithSAML permission to the corporate Identity Provider.

Answer

To configure the trust relationship for SAML 2.0 identity federation in a multi-account environment, you must create an IAM SAML identity provider in the member account using the corporate Identity Provider's XML metadata document, and configure the trust policy of the target IAM role to define the SAML identity provider as the Principal with the sts:AssumeRoleWithSAML action.
Establishing direct SAML 2.0 federation requires creating an IAM SAML identity provider in the target AWS account where the role is located, and configuring the trust policy of that role to authorize the SAML provider using the sts:AssumeRoleWithSAML action.

Step-by-Step Solution

1
Obtain the SAML metadata document from the corporate Identity Provider (IdP).
An XML file containing the identity provider's configuration, certificates, and endpoints.
This metadata document is required by AWS to establish a trust relationship with the IdP.
2
Create an IAM SAML identity provider in the target member account using the obtained metadata document.
An IAM SAML provider resource is created in the member account with a unique ARN.
Each member account must have its own SAML provider configuration to establish a local trust anchor.
3
Configure the trust policy of the NetworkAdminRole in the member account.
The role's trust policy is updated to set the federated principal to the SAML provider ARN and allow the sts:AssumeRoleWithSAML action.
This allows authenticated users from the corporate IdP to assume the specific role and obtain temporary security credentials.

Key Concept

SAML 2.0 Federation Trust Relationship Configuration
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic