Examkin

Question

Difficulty: EasyMulti-Account Identity and Access Management Federation

An administrator is configuring single sign-on (SSO) integration between an on-premises SAML 2.0 Identity Provider (IdP) and an AWS account. The administrator creates an IAM role to represent the federated users. Which action must be specified in the trust policy of this IAM role to allow the SAML provider to authenticate users?

  1. sts:AssumeRoleWithSAMLAnswer
  2. B
    sts:AssumeRoleWithWebIdentity
  3. C
    sts:AssumeRole
  4. D
    sts:AssumeRole with a Service Control Policy (SCP) attached to the root of the organization that allows access to the SAML provider

Answer

The trust policy of the IAM role must specify the action 'sts:AssumeRoleWithSAML' to allow the SAML 2.0 Identity Provider to federate users.
The correct action to configure in the trust policy for SAML 2.0 federation is 'sts:AssumeRoleWithSAML'. This allows AWS Security Token Service (STS) to validate the SAML assertion and return temporary security credentials.

Step-by-Step Solution

1
Identify the type of identity federation being configured.
The identity provider uses SAML 2.0.
SAML 2.0 federation uses a specific STS API action that differs from OIDC or basic cross-account trust.
2
Select the correct AWS Security Token Service (STS) action for the trust policy.
The action 'sts:AssumeRoleWithSAML' is chosen.
This is the only action that allows STS to exchange SAML assertions for temporary AWS security credentials.

Key Concept

SAML 2.0 federation trust policies require the specific STS action 'sts:AssumeRoleWithSAML' to authorize external SAML identity providers.

Alternative Method

If AWS IAM Identity Center is used, the configuration of IAM role trust policies is managed automatically by the service, eliminating the need to write custom trust policies manually.
Estimated Time:45s
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic