Examkin

Question

Difficulty: HardMulti-Account Identity and Access Management Federation

An enterprise manages its applications across 50 AWS accounts organized under AWS Organizations. The security team is designing a federated identity solution using an external SAML 2.0 compliant Identity Provider (IdP). To minimize administrative overhead and centralize user authentication, the team plans to establish the SAML trust relationship in a single dedicated Identity AWS account. Corporate engineers must be able to use the AWS CLI to authenticate via the external IdP and obtain temporary security credentials to access specific target roles in various production and development member accounts. Which combination of configuration steps is required to implement this federated access model? (Select TWO.)

  1. In the central Identity account, create a SAML identity provider and a federated IAM role, then configure this role's trust policy to allow the `sts:AssumeRoleWithSAML` action from the SAML identity provider principal.Answer
  2. In the target member accounts, configure the trust policy of each target role to allow the `sts:AssumeRole` action, specifying the Amazon Resource Name (ARN) of the federated IAM role in the central Identity account as the principal.Answer
  3. C
    In the central Identity account, configure the federated IAM role's trust policy to allow the `sts:AssumeRole` action for the SAML identity provider principal.
  4. D
    In each target member account, configure the role's trust policy to permit the `sts:AssumeRoleWithSAML` action directly referencing the external SAML identity provider's metadata URL without creating a SAML provider resource in the member account.
  5. E
    Apply a Service Control Policy (SCP) to the Organizational Unit (OU) containing the member accounts that explicitly grants the central federated role permission to assume any role in the OU, removing the need for trust policies in the member accounts.

Answer

In the central Identity account, create a SAML identity provider and a federated IAM role, then configure this role's trust policy to allow the sts:AssumeRoleWithSAML action from the SAML identity provider principal; and in the target member accounts, configure the trust policy of each target role to allow the sts:AssumeRole action, specifying the Amazon Resource Name (ARN) of the federated IAM role in the central Identity account as the principal.
Establishing federated access in a centralized identity account (the 'hop' model) requires a SAML provider resource and a federated IAM role configured with `sts:AssumeRoleWithSAML`. To enable access to target member accounts, those target roles must explicitly trust the central federated role as a principal using `sts:AssumeRole`. This combined structure minimizes identity provider configuration overhead while maintaining strict least-privilege delegation across the organization.

Step-by-Step Solution

1
Configure SAML federation in the central Identity account.
Create an IAM SAML provider and a federated IAM role. Set the trust policy of this federated role to allow the action `sts:AssumeRoleWithSAML` when called by the SAML provider principal.
This establishes the initial trust relationship allowing external IdP users to authenticate into AWS and obtain temporary credentials in the central Identity account.
2
Configure cross-account trust in the target member accounts.
Create target IAM roles in each member account. Set their trust policies to allow the `sts:AssumeRole` action, specifying the federated role's ARN from the central Identity account as the principal.
This establishes cross-account trust, enabling users who have assumed the federated role in the central Identity account to assume the role in the destination accounts.
3
Configure CLI authentication flow.
The CLI helper authenticates to the external SAML IdP, uses the assertion to invoke `sts:AssumeRoleWithSAML` on the central federated role, and then invokes `sts:AssumeRole` on the target member role.
This programmatic flow allows developers to navigate across accounts without needing separate SAML configurations in every single member account.

Key Concept

Cross-account IAM delegation combined with centralized SAML federation (the 'hop' model).
Estimated Time:3m 0s
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic