Examkin

Question

Difficulty: HardMulti-Account Identity and Access Management Federation

An enterprise is designing a centralized identity federation strategy for its multi-account AWS environment managed under AWS Organizations. The security team is configuring an external SAML 2.0 Identity Provider (IdP) to allow corporate users to authenticate and assume IAM roles in member accounts. The architecture must support Attribute-Based Access Control (ABAC) by dynamically passing user department tags from the IdP to the target AWS sessions. Additionally, central administrators must enforce guardrails that prevent member account administrators from altering the federation setup, while still requiring member account administrators to manage local resource permissions. Which combination of actions must the solutions architect perform to meet these requirements? (Select TWO.)

  1. Configure the external SAML IdP to pass the department attribute as a session tag using the claim name 'https://aws.amazon.com/SAML/Attributes/PrincipalTag:Department'. In the member accounts, configure the trust policy of the target IAM roles to allow the 'sts:AssumeRoleWithSAML' and 'sts:TagSession' actions for the SAML provider principal.Answer
  2. B
    Configure the external SAML IdP to pass the department attribute as a session tag using the claim name 'https://aws.amazon.com/SAML/Attributes/PrincipalTag:Department'. In the member accounts, configure the trust policy of the target IAM roles to allow 'sts:AssumeRole' and 'sts:TagSession' actions for the SAML provider principal.
  3. Create a Service Control Policy (SCP) and attach it to the organization's root to deny 'iam:DeleteSAMLProvider' and 'iam:UpdateSAMLProvider' actions. Ensure that local IAM policies in the member accounts explicitly grant resource-level permissions to the federated roles.Answer
  4. D
    Create a Service Control Policy (SCP) and attach it to the Organizational Unit (OU) containing the member accounts to allow resource access for federated roles containing the 'aws:PrincipalTag/Department' condition, eliminating the need for local IAM policies to grant permissions.
  5. E
    Configure the SAML assertion to include the user's department in the Subject NameID attribute. In the member accounts, construct local IAM policies that use the 'aws:username' policy variable to dynamically restrict access based on the department value.

Answer

Configure the external SAML IdP to pass the department attribute as a session tag under the PrincipalTag namespace, update target IAM role trust policies to allow the 'sts:AssumeRoleWithSAML' and 'sts:TagSession' actions, and create an SCP at the organization's root to prevent modification of the SAML provider while relying on local member account IAM policies to grant access.
The correct solution involves mapping the department attribute to the 'https://aws.amazon.com/SAML/Attributes/PrincipalTag:Department' claim in the SAML assertion, updating the trust policy of the IAM roles in member accounts to permit both 'sts:AssumeRoleWithSAML' and 'sts:TagSession', and applying an SCP at the organization's root to prevent modification of the SAML provider while leaving local resource permission configuration to local IAM policies. This satisfies all administrative and Attribute-Based Access Control (ABAC) requirements.

Step-by-Step Solution

1
Enable session tags in the SAML assertion by configuring the Identity Provider.
Attributes are mapped to the 'https://aws.amazon.com/SAML/Attributes/PrincipalTag:Department' claim.
This specific namespace tells AWS to ingest the SAML attributes as session tags, which can then be evaluated dynamically via the 'aws:PrincipalTag/Department' condition key in policies.
2
Update the IAM role trust policy in the target member accounts to authorize the federation process and tag ingestion.
The trust policy allows the 'sts:AssumeRoleWithSAML' action for the SAML provider and includes the 'sts:TagSession' action.
SAML federation requires the trust policy to permit the 'sts:AssumeRoleWithSAML' action, and passing principal tags requires the 'sts:TagSession' action to be explicitly authorized in the trust relationship.
3
Implement organization-wide guardrails using a Service Control Policy (SCP) at the root level.
A policy is applied that denies modification or deletion of the SAML provider ('iam:DeleteSAMLProvider', 'iam:UpdateSAMLProvider').
This prevents administrators in the member accounts from bypassing or deleting the identity federation setup, ensuring compliance with central security requirements.
4
Define local permissions in the member accounts.
IAM policies are attached to the federated roles in member accounts to grant access to specific AWS resources based on the department session tag.
Since SCPs can only restrict permissions and do not grant them, local IAM policies are required in each member account to provide the actual access.

Key Concept

Centralized SAML 2.0 Identity Federation with Session Tags (ABAC) and SCP Guardrails
Estimated Time:3m 0s
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic