Examkin

Question

Difficulty: Very hardMulti-Account Identity and Access Management Federation

A financial services company is designing a multi-account architecture using AWS Organizations with 50 member accounts. Security policies require that administrators authenticate using the company's on-premises SAML 2.0 compliant Identity Provider (IdP) to access a highly privileged role named AdminAccessRole in each member account. The security requirements are as follows:
- Federated administrative sessions must support a duration of up to 4 hours.
- Administrators must be blocked from assuming the AdminAccessRole if they did not perform Multi-Factor Authentication (MFA) at the corporate IdP.
Which combination of actions must a solutions architect take to meet these requirements? (Select TWO.)

  1. Create an IAM SAML identity provider in each of the 50 member accounts using the XML metadata document from the corporate IdP. In each member account, create the AdminAccessRole with a trust policy that lists the local SAML provider as the principal and allows the sts:AssumeRoleWithSAML action.Answer
  2. Configure the trust policy of the AdminAccessRole in each member account to include a condition block verifying that the SAML:AuthnContextClassRef key matches multi-factor authentication context classes, and set the role's MaxSessionDuration attribute to 14400 seconds.Answer
  3. C
    Establish a hub-and-spoke model by creating the SAML identity provider and a gateway IAM role in a central identity account. Have users federate into the identity account first, and then perform role chaining to assume the target AdminAccessRole in the member accounts, setting the target role's MaxSessionDuration to 14400 seconds.
  4. D
    Apply a Service Control Policy (SCP) at the root level of the AWS Organization that denies the sts:AssumeRoleWithSAML action unless the aws:MultiFactorAuthPresent condition key is set to true.

Answer

To meet the requirements, the solutions architect must create a SAML identity provider in each member account to allow direct federation, configure the trust policies to validate the SAML:AuthnContextClassRef attribute for MFA, and set the MaxSessionDuration to 14400 seconds.
To support a 4-hour session duration, users must federate directly into the target member accounts rather than using a hub-and-spoke role chaining model, which imposes a hard 1-hour limit on session duration. Direct federation requires creating a SAML identity provider in each member account and creating the target role with a trust policy that allows the sts:AssumeRoleWithSAML action. Furthermore, because AWS-managed Multi-Factor Authentication (MFA) is not used for external identity providers, the aws:MultiFactorAuthPresent key evaluates to false or null. Instead, the solutions architect must configure the trust policy to inspect the SAML:AuthnContextClassRef attribute sent in the SAML assertion to verify that MFA occurred at the IdP.

Step-by-Step Solution

1
Analyze session duration requirements for federated users.
Determine that role chaining limits sessions to 1 hour, meaning users must federate directly to each target account to support a 4-hour session.
AWS enforces a hard 1-hour limit on role sessions assumed via role chaining (AssumeRole).
2
Establish trust relationships in target member accounts.
Create a SAML identity provider in each of the 50 member accounts and create the target IAM role with a trust policy allowing AssumeRoleWithSAML.
SAML identity providers must exist locally in each account where direct federation is performed.
3
Configure Multi-Factor Authentication enforcement for federated access.
Use the SAML:AuthnContextClassRef key in the trust policy condition block to check for MFA-specific authentication context classes.
The standard aws:MultiFactorAuthPresent key is not populated for external SAML federated sessions.
4
Configure the session duration limit on the target roles.
Set the MaxSessionDuration attribute of the AdminAccessRole to 14400 seconds (4 hours).
This allows the federated session to remain valid for the requested 4 hours, assuming the SAML assertion also permits it.

Key Concept

Multi-Account SAML 2.0 Federation Session Limits and MFA Validation
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic