Examkin

Question

Difficulty: EasyMulti-Account Identity and Access Management Federation

A company is setting up identity federation to allow corporate directory users to access the AWS Management Console of a new member account. The directory uses an on-premises SAML 2.0 identity provider (IdP). To establish federation trust in the AWS account, which two configuration steps must the solutions architect perform?

  1. Create a SAML identity provider entity in AWS IAM by uploading the SAML metadata document obtained from the on-premises IdP.Answer
  2. Create an IAM role with a trust policy that allows the sts:AssumeRoleWithSAML action and references the SAML identity provider's ARN in the Principal block.Answer
  3. C
    Create an IAM role with a trust policy that allows the sts:AssumeRole action and references the SAML identity provider's ARN in the Principal block.
  4. D
    Create a Service Control Policy (SCP) at the root of the AWS Organization to allow external SAML authentication across member accounts.

Answer

To establish SAML federation trust, create a SAML identity provider entity in AWS IAM by uploading the SAML metadata document, and create an IAM role with a trust policy that allows the sts:AssumeRoleWithSAML action and references the SAML identity provider's ARN as the Principal.
Establishing trust with an external SAML 2.0 IdP requires two primary configuration steps: first, creating a SAML provider entity in IAM using the IdP's metadata document to establish the cryptographic trust; second, creating an IAM role whose trust policy designates the SAML provider as a principal and permits the sts:AssumeRoleWithSAML action to allow authenticated users to exchange their SAML assertion for AWS credentials.

Step-by-Step Solution

1
Create a SAML identity provider entity in AWS IAM using the XML metadata document from the corporate identity provider.
The identity provider is registered in the account with a unique ARN, serving as a trust endpoint.
AWS IAM requires the metadata document to verify the signatures of SAML assertions sent by the external IdP.
2
Create an IAM role that defines the permissions for federated users and configure its trust relationship.
The role's trust policy specifies the SAML provider as the trusted principal and allows the sts:AssumeRoleWithSAML action.
This configuration allows users authenticated by the external IdP to assume the role and obtain temporary credentials to access AWS resources.

Key Concept

Configuring SAML 2.0 federation requires registering the identity provider in the target AWS account and associating it with an IAM role whose trust policy specifically enables sts:AssumeRoleWithSAML.
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic