Examkin

Question

Difficulty: HardMulti-Account Identity and Access Management Federation

An enterprise manages a multi-account AWS environment using AWS Organizations. The security team is setting up federated access from their on-premises SAML 2.0 Identity Provider (IdP) to a shared target account containing development resources. They want users in the IdP's 'AdminGroup' to assume an IAM role named FederatedDeveloperRole in the target account. Additionally, they must implement Attribute-Based Access Control (ABAC) using session tags (PrincipalTag:CostCenter and PrincipalTag:Team) passed during federation. The solutions architect must configure the trust relationship and assertion attributes to allow this federation while enforcing that these tags are present.

Which two actions should the solutions architect perform to successfully implement this configuration? (Select two.)

  1. Configure the trust policy of the FederatedDeveloperRole in the target account to allow the SAML provider principal to perform the actions sts:AssumeRoleWithSAML and sts:TagSession.Answer
  2. Configure the SAML assertion in the on-premises Identity Provider (IdP) to include user attributes mapped to the claims https://aws.amazon.com/SAML/Attributes/PrincipalTag:CostCenter and https://aws.amazon.com/SAML/Attributes/PrincipalTag:Team.Answer
  3. C
    Configure the trust policy of the FederatedDeveloperRole with the action sts:AssumeRole, specifying the SAML provider's ARN as the Principal, and use a condition checking aws:PrincipalOrgID.
  4. D
    Configure the SAML assertion in the on-premises Identity Provider (IdP) to pass the session tags as a comma-separated list of values under the single attribute claim https://aws.amazon.com/SAML/Attributes/RoleSessionName.
  5. E
    Apply a Service Control Policy (SCP) at the Organizational Unit (OU) level containing the target account that allows sts:AssumeRoleWithSAML and defines the allowed values for the CostCenter and Team tags.

Answer

Configure the trust policy of the FederatedDeveloperRole in the target account to allow the SAML provider principal to perform the actions sts:AssumeRoleWithSAML and sts:TagSession, and configure the SAML assertion in the on-premises Identity Provider (IdP) to include user attributes mapped to the claims https://aws.amazon.com/SAML/Attributes/PrincipalTag:CostCenter and https://aws.amazon.com/SAML/Attributes/PrincipalTag:Team.
To implement SAML 2.0 federation with session tags for ABAC, two main components must be configured. First, the IAM role trust policy in the target AWS account must allow the federated principal to perform the sts:AssumeRoleWithSAML action (to permit SAML federation) and the sts:TagSession action (to authorize passing session tags). Second, the SAML identity provider must include attributes in the SAML assertion mapped to the specific namespace https://aws.amazon.com/SAML/Attributes/PrincipalTag: followed by the tag keys (CostCenter and Team).

Step-by-Step Solution

1
Configure the SAML identity provider in AWS to establish trust with the on-premises IdP.
The target AWS account trusts the metadata of the external SAML IdP.
This is a prerequisite for any federated role assumption.
2
Create the FederatedDeveloperRole and write its trust policy.
The role's trust policy specifies the SAML provider as the Principal, and lists both sts:AssumeRoleWithSAML and sts:TagSession in the Action block.
The sts:AssumeRoleWithSAML action allows the federation, and the sts:TagSession action is mandatory to authorize passing session tags (attributes) during the STS session initiation.
3
Configure the SAML assertions on the external IdP to populate the user's CostCenter and Team values.
The SAML assertions contain attributes named 'https://aws.amazon.com/SAML/Attributes/PrincipalTag:CostCenter' and 'https://aws.amazon.com/SAML/Attributes/PrincipalTag:Team'.
AWS STS reads these specific attribute patterns to apply tags to the temporary federated session, which allows ABAC policies to evaluate resource access.

Key Concept

SAML 2.0 federation with Attribute-Based Access Control (ABAC) in multi-account environments.
Estimated Time:2m 30s
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic