Examkin

Question

Difficulty: EasyMulti-Account Identity and Access Management Federation

An enterprise is migrating its workforce identity management to a centralized model and needs to establish single sign-on (SSO) access for internal engineers. The engineers must be able to log into multiple AWS member accounts within their AWS Organization using their existing Active Directory credentials via a SAML 2.0 compliant Identity Provider (IdP). Which of the following configuration steps are required in the target member accounts to enable this federation? (Select TWO.)

  1. Create an IAM SAML identity provider in each target account using the SAML metadata document from the enterprise Identity Provider.Answer
  2. Create an IAM role in each target account with a trust policy that permits the AssumeRoleWithSAML action from the local SAML identity provider principal.Answer
  3. C
    Attach a Service Control Policy (SCP) at the root of the AWS Organization that grants the AssumeRoleWithSAML permission to all member accounts.
  4. D
    Create an IAM role in each target account with a trust policy that allows the standard AssumeRole action for the AWS Organization's management account.
  5. E
    Register the SAML identity provider once in the management account and share it with member accounts using AWS Resource Access Manager.

Answer

To configure federated access using an external SAML Identity Provider (IdP) in a multi-account environment, the Solutions Architect must create an IAM SAML identity provider in each target member account using the IdP's metadata document. Additionally, an IAM role must be created in each target member account with a trust policy that references the SAML identity provider as the principal and allows the AssumeRoleWithSAML action.
Establishing federated access via a SAML 2.0 Identity Provider requires two core configuration steps in each target account. First, the SAML provider metadata must be imported into the account to define the trust anchor (the IAM SAML identity provider). Second, a target role must be created with a trust policy that allows the AssumeRoleWithSAML action, which permits users authenticated by the SAML IdP to assume the role and receive AWS credentials.

Step-by-Step Solution

1
Configure the IAM SAML Identity Provider
An IAM SAML identity provider is registered in each target AWS member account using the corporate IdP's XML metadata document.
This establishes a cryptographically verified trust relationship between the specific AWS account and the external SAML IdP.
2
Configure IAM Roles with federated trust policies
IAM roles are created in each target account with a trust policy allowing the AssumeRoleWithSAML action.
The trust policy permits the external SAML provider to invoke the AssumeRoleWithSAML API, enabling authenticated users to obtain temporary security credentials.

Key Concept

Establishing SAML 2.0 identity federation requires registering an IAM SAML identity provider in target accounts and configuring an IAM role with a trust policy allowing the AssumeRoleWithSAML action.
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic