Examkin

Question

Difficulty: MediumMulti-Account Identity and Access Management Federation

An enterprise is configuring federated access to its multi-account AWS environment using an external SAML 2.0 Identity Provider (IdP). The Solutions Architect needs to establish trust and enable users authenticated by the external IdP to assume a specific read-only IAM role in multiple member accounts managed under AWS Organizations. Which of the following configuration steps are required to establish this federation trust relationship and allow users to access the member accounts? (Select TWO.)

  1. In each member account, create an IAM SAML identity provider using the SAML metadata document from the external IdP, and create an IAM role with a trust policy that allows the sts:AssumeRoleWithSAML action for the SAML provider ARN.Answer
  2. Configure the external IdP to output SAML assertions that include the https://aws.amazon.com/SAML/Attributes/Role attribute mapping the IAM role ARN to the SAML provider ARN, and the https://aws.amazon.com/SAML/Attributes/RoleSessionName attribute.Answer
  3. C
    In each member account, create an IAM role with a trust policy that allows the standard sts:AssumeRole action and sets the principal to the AWS SAML service endpoint URL.
  4. D
    Create a Service Control Policy (SCP) at the root of the AWS Organization that allows the sts:AssumeRoleWithSAML action, which automatically propagates the SAML identity provider metadata and roles to all member accounts.
  5. E
    Register the SAML identity provider only in the AWS Organizations management account, and configure member accounts to trust the management account's IAM service principal using sts:AssumeRole.

Answer

In each member account, create an IAM SAML identity provider using the SAML metadata document from the external IdP, and create an IAM role with a trust policy that allows the sts:AssumeRoleWithSAML action for the SAML provider ARN; and configure the external IdP to output SAML assertions that include the https://aws.amazon.com/SAML/Attributes/Role attribute mapping the IAM role ARN to the SAML provider ARN, and the https://aws.amazon.com/SAML/Attributes/RoleSessionName attribute.
Establishing a SAML 2.0 federation to multiple member accounts requires configuring trust on both sides. On the AWS side, each member account must have a registered IAM SAML identity provider and an IAM role configured with a trust policy that references that provider and permits the sts:AssumeRoleWithSAML action. On the identity provider side, the IdP must issue assertions containing the mandatory AWS SAML attributes: the Role attribute (specifying the role and provider ARN pair) and the RoleSessionName attribute (providing a session identifier for logging).

Step-by-Step Solution

1
Set up the identity trust inside the AWS member accounts.
An IAM SAML identity provider is created in each target account, establishing a cryptographic trust between AWS and the external IdP.
Each member account must recognize the external IdP as a trusted issuer of security assertions.
2
Create the IAM roles with trust policies referencing the SAML provider.
IAM roles are configured with a trust policy that allows the sts:AssumeRoleWithSAML action, targeted to the specific SAML provider ARN.
This grants permission to the federated users to assume the specific IAM role.
3
Configure the IdP claims mapping.
The IdP sends the mandatory AWS-specific SAML attributes (Role and RoleSessionName) in its SAML assertions.
AWS relies on these attributes to map the incoming user to the correct IAM role and SAML provider in the target account.

Key Concept

Direct SAML 2.0 federation configuration requires both trust registration in the target AWS account (using the sts:AssumeRoleWithSAML action in the role trust policy) and correct mapping of SAML attributes (Role and RoleSessionName) within the external Identity Provider.
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic