Examkin

Question

Difficulty: MediumMulti-Account Identity and Access Management Federation

A logistics company utilizes AWS Organizations to manage a multi-account environment. The identity team has configured SAML 2.0 federation with an external Identity Provider (IdP) to allow engineers to access resources in a shared development account. During testing, users are successfully redirected from the IdP dashboard to the AWS sign-in portal, but they encounter an access denied error before they can select their role. The trust policy of the target IAM role in the development account is configured with the SAML provider as the Federated principal, the Action set to `sts:AssumeRole`, and the condition `SAML:aud` set to `https://signin.aws.amazon.com/saml`.

Which modification must the Solutions Architect make to the target IAM role's trust policy to resolve this issue?

  1. A
    Modify the Action in the trust policy to `sts:AssumeRoleWithWebIdentity` to support federated authentication.
  2. B
    Change the Federated principal in the trust policy to point to the AWS STS service endpoint instead of the SAML provider ARN.
  3. Change the Action in the trust policy from `sts:AssumeRole` to `sts:AssumeRoleWithSAML`.Answer
  4. D
    Ensure that a Service Control Policy (SCP) is attached to the development account's Organizational Unit (OU) that explicitly grants the `sts:AssumeRole` permission to the federated users.

Answer

Change the Action in the trust policy from `sts:AssumeRole` to `sts:AssumeRoleWithSAML`.
SAML 2.0 identity federation requires the trust policy of the target IAM role to specify the `sts:AssumeRoleWithSAML` action. When the Identity Provider redirects the user, the browser calls the AWS STS service using this action. Using `sts:AssumeRole` fails because it is meant for cross-account IAM role assumption or local service assumption, not federated authentication.

Step-by-Step Solution

1
Analyze the configuration of the SAML provider trust policy in the target AWS account.
Identify that the Action is currently set to `sts:AssumeRole`.
SAML 2.0 federation requires the specific AWS STS API call `sts:AssumeRoleWithSAML` to exchange the SAML assertion for credentials.
2
Update the Action element within the trust policy statement.
The Action matches the required `sts:AssumeRoleWithSAML` endpoint.
This allows the STS service to evaluate the SAML assertion and authenticate the user.
3
Validate the principal and condition keys.
The principal correctly points to the SAML provider ARN and the condition evaluates the correct audience.
Ensures the trust relationship is secure and points to the correct local SAML configuration.

Key Concept

IAM SAML Trust Policies and STS Actions
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic