Examkin

Question

Difficulty: MediumMulti-Account Identity and Access Management Federation

An enterprise is implementing federated access to its production database AWS account. The database administrators must authenticate via an external SAML 2.0-compliant Identity Provider (IdP) and assume a specific administrative role (db-admin-role) in the database account. A Solutions Architect has created an IAM SAML identity provider in the target database account. However, when database administrators attempt to log in through the IdP portal, the authentication fails with a 'Not authorized to perform sts:AssumeRoleWithSAML' error. Which configuration change in the database AWS account will resolve this authentication failure?

  1. Update the trust policy of the database account's IAM role to specify the SAML identity provider as the Principal and allow the sts:AssumeRoleWithSAML action.Answer
  2. B
    Update the trust policy of the database account's IAM role to specify the SAML identity provider as the Principal and allow the standard sts:AssumeRole action.
  3. C
    Attach a Service Control Policy (SCP) at the Organizational Unit (OU) level that defines the SAML identity provider as a trusted entity and grants permission for sts:AssumeRoleWithSAML.
  4. D
    Update the key policy of the database account's default AWS-managed KMS key (aws/iam) to permit the sts:AssumeRoleWithSAML action for the SAML identity provider.

Answer

Update the trust policy of the database account's IAM role to specify the SAML identity provider as the Principal and allow the sts:AssumeRoleWithSAML action.
To authenticate external users via SAML 2.0, the target IAM role must have a trust policy that explicitly designates the IAM SAML provider as a federated principal and allows the sts:AssumeRoleWithSAML action. This allows the AWS Security Token Service (STS) to validate the SAML assertion and issue temporary credentials.

Step-by-Step Solution

1
Analyze the error message 'Not authorized to perform sts:AssumeRoleWithSAML'.
Identify that the federation flow requires the target IAM role to trust the SAML Identity Provider (IdP) for the specific sts:AssumeRoleWithSAML action.
SAML federation does not use the standard sts:AssumeRole action, but rather a dedicated API call designed for federating external users.
2
Review the trust policy of the target IAM role in the database account.
Ensure the Principal block references the ARN of the IAM SAML identity provider created in that account, and the Action is set to sts:AssumeRoleWithSAML.
The trust policy is the gatekeeper that allows external SAML assertions to exchange for temporary AWS security credentials.
3
Verify that Service Control Policies (SCPs) and KMS keys are not used to establish authentication trust.
Confirm that permission configuration lies within the IAM role trust policy and cannot be bypassed or configured via SCPs or AWS-managed KMS keys.
SCPs act as boundaries, not permission grantors, and AWS-managed KMS keys cannot have their policies altered.

Key Concept

SAML 2.0 federation trust relationships in AWS IAM
Estimated Time:1m 30s
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic