Examkin

Question

Difficulty: MediumMulti-Account Identity and Access Management Federation

An organization is establishing a secure deployment pipeline from an external OIDC-compliant CI/CD platform to multiple target AWS member accounts within their AWS Organization. A solutions architect must design a federation trust model that allows runners to assume a deployment role (DeployRole) only when executing workflows from a specific repository (org/repo-a) and branch (main), without relying on long-lived credentials. Which of the following configuration steps must the solutions architect perform to establish this federation model? (Choose TWO.)

  1. Create an IAM OpenID Connect (OIDC) identity provider in each target AWS account, using the external CI/CD platform's issuer URL and setting the client ID configured to match the audience string.Answer
  2. Configure the trust policy of the deployment role in the target AWS accounts with the sts:AssumeRoleWithWebIdentity action, setting the principal to the IAM OIDC provider's ARN and adding a condition that filters the subject claim (sub) for the authorized repository and branch.Answer
  3. C
    Configure the deployment role trust policy in the target AWS accounts to allow the sts:AssumeRole action, specifying the ARN of the IAM OIDC provider as the principal.
  4. D
    Create an IAM SAML 2.0 identity provider in the target accounts and configure the deployment role trust policy to use the sts:AssumeRoleWithSAML action, while using a Service Control Policy (SCP) to filter the subject claim.
  5. E
    Create a centralized IAM OIDC identity provider in the AWS Organizations management account, and attach a Service Control Policy (SCP) to target OUs that grants member accounts trust to assume roles via the management account's OIDC provider.

Answer

To establish OIDC federation with an external CI/CD platform, you must create an IAM OIDC identity provider in each target account using the platform's issuer URL and audience client ID, and then configure the deployment role's trust policy in the target accounts to allow the sts:AssumeRoleWithWebIdentity action with a condition filtering on the repository and branch subject claim.
The correct options are: creating an IAM OIDC provider in each target account using the issuer URL and client ID, and configuring the deployment role trust policy with sts:AssumeRoleWithWebIdentity while filtering the subject claim. Registering the OIDC identity provider establishes the trust anchor in the target accounts. Configuring the trust policy with the correct action and claim filtering allows authentication to succeed securely for the specific repository and branch.

Step-by-Step Solution

1
Register the OIDC provider in the target accounts
An IAM OIDC identity provider resource is created in each member account pointing to the external provider's issuer URL and configured with the correct client ID.
Establishing the OIDC identity provider resource within each local account registers the trust anchor for validating JWTs signed by the external provider.
2
Define the IAM role trust policy configuration
The target role trust policy is set up with the sts:AssumeRoleWithWebIdentity action and the OIDC provider as the principal.
OIDC token exchange requires the AssumeRoleWithWebIdentity API operation, and specifying the OIDC provider ARN maps the external identity validation to this local IAM role.
3
Add claim conditions to limit authorization
A StringEquals or StringLike condition evaluates the OIDC subject (sub) claim to match the repository name and branch.
Without this condition, any runner authenticated by the external OIDC provider (including other repositories) could assume the role, creating a security vulnerability.

Key Concept

Establishing direct OIDC federation in a multi-account environment requires creating local IAM OIDC providers and configuring trust policies with sts:AssumeRoleWithWebIdentity and subject claim filters.
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic