An enterprise is designing a multi-account AWS environment utilizing AWS Organizations. The enterprise has a corporate identity provider (IdP) that supports SAML 2.0. Users in the IdP must be able to authenticate and gain access to resources across multiple AWS member accounts based on their department attributes. The security architect wants to configure direct federation to the member accounts using IAM SAML Identity Providers and IAM Roles. To enforce centralized security, a Service Control Policy (SCP) is applied at the root of the organization. During implementation, users are unable to authenticate and receive access denied errors. Which TWO configuration steps are required to establish the trust relationship and resolve the authentication failures? (Select TWO.)
- Configure an IAM SAML identity provider in each target member account, and create a federated IAM role in each member account with a trust policy that allows the 'sts:AssumeRoleWithSAML' action for the local SAML provider principal.Answer
- Configure the corporate SAML Identity Provider to send assertions containing the 'https://aws.amazon.com/SAML/Attributes/Role' attribute, specifying the comma-separated ARNs of the target IAM role and the local SAML provider in the member account.Answer
- CConfigure the trust policy of the IAM roles in the member accounts to use 'sts:AssumeRole' instead of 'sts:AssumeRoleWithSAML' to enable cross-account access, since SAML assertions are validated globally by AWS STS.
- DAttach a Service Control Policy (SCP) to the organization's root OU that grants the 'sts:AssumeRoleWithSAML' action to the corporate IdP principal, which automatically creates the trust relationship and grants federated access to all member accounts.
- ESet up a single SAML provider in the organization's management account and configure the IAM roles in the member accounts to use 'sts:AssumeRoleWithWebIdentity' with the management account's SAML provider as the federated principal.