Examkin

Question

Difficulty: HardMulti-Account Identity and Access Management Federation

A logistics corporation is consolidating its IT operations across multiple acquired subsidiaries by deploying a multi-account landing zone using AWS Organizations. The security team is setting up direct SAML 2.0-based identity federation to target accounts, bypassing AWS IAM Identity Center due to custom legacy attribute mapping requirements from an on-premises Shibboleth Identity Provider (IdP). During pilot testing, users receive access denied errors immediately after selecting their role on the AWS federation portal. Analysis reveals that the federated roles are configured with session tags for Attribute-Based Access Control (ABAC), but the tags are not being evaluated, and user sessions are expiring too quickly for long-running database maintenance tasks.

Which of the following configuration steps must the solutions architect perform to successfully resolve these federation and session lifecycle issues? (Select TWO.)

  1. In the target IAM roles, update the trust policy to allow both 'sts:AssumeRoleWithSAML' and 'sts:TagSession' actions for the federated SAML provider principal, and configure the Shibboleth IdP to release SAML attributes mapped to the 'https://aws.amazon.com/SAML/Attributes/PrincipalTag:' namespace.Answer
  2. Increase the 'Maximum CLI/API session duration' setting on the target IAM roles up to 12 hours, and configure the Shibboleth IdP to include the 'https://aws.amazon.com/SAML/Attributes/SessionDuration' attribute in the SAML assertion.Answer
  3. C
    Attach a Service Control Policy (SCP) at the root of the AWS Organization that explicitly allows the 'sts:AssumeRoleWithSAML' and 'sts:TagSession' actions, ensuring the policy overrides local IAM role trust policy limitations.
  4. D
    Update the target IAM roles' trust policies to trust the AWS Organizations management account root principal, and delegate the SAML provider configuration and 'sts:AssumeRoleWithSAML' actions entirely to the centralized identity account.

Answer

To resolve the issues, the trust policies of the target IAM roles must be updated to permit both the 'sts:AssumeRoleWithSAML' and 'sts:TagSession' actions, and the Shibboleth Identity Provider must be configured to map attributes to the 'https://aws.amazon.com/SAML/Attributes/PrincipalTag:' namespace. Additionally, to resolve the session expiration issue, the solutions architect must increase the maximum session duration setting on the target IAM roles and configure the Identity Provider to send the 'https://aws.amazon.com/SAML/Attributes/SessionDuration' attribute in the SAML assertion.
The correct configurations involve setting up the IAM role trust policy to permit both role assumption and session tagging. For ABAC, the trust policy must explicitly allow the 'sts:TagSession' action alongside 'sts:AssumeRoleWithSAML'. The IdP must also be configured to pass the tags under the correct 'https://aws.amazon.com/SAML/Attributes/PrincipalTag:' prefix. To handle long-running tasks, the 'SessionDuration' attribute must be passed by the IdP in the SAML assertion, and the target IAM role's maximum session duration setting must be increased accordingly, as the default session duration for federated access is 1 hour.

Step-by-Step Solution

1
Enable session tagging on the federated roles by modifying their trust policies.
The target IAM roles will accept principal tags passed from the identity provider when the 'sts:TagSession' action is explicitly permitted alongside 'sts:AssumeRoleWithSAML'.
Without 'sts:TagSession' in the trust policy, attempts to pass session tags during federation will fail with an access denied error.
2
Configure attribute mappings in the Shibboleth IdP to release principal tags.
Attributes will be passed in the SAML assertion with the prefix 'https://aws.amazon.com/SAML/Attributes/PrincipalTag:'.
AWS requires this specific namespace to automatically convert SAML attributes into session tags available for ABAC evaluation.
3
Adjust maximum session duration settings in both AWS IAM and the Shibboleth IdP.
The target roles' 'Maximum CLI/API session duration' is increased, and the IdP is set to send the 'https://aws.amazon.com/SAML/Attributes/SessionDuration' attribute.
By default, federated sessions expire in 1 hour. Increasing the duration requires both the role to allow a longer limit and the IdP assertion to request it.

Key Concept

Direct SAML 2.0 federation trust policies, principal tagging for ABAC, and session duration attributes in AWS multi-account landing zones.
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic