Examkin

Question

Difficulty: HardMulti-Account Identity and Access Management Federation

A multi-player online gaming platform hosts its workloads across hundreds of AWS accounts managed under a single organization in AWS Organizations. The company uses an external SAML 2.0-compliant Identity Provider (IdP) to manage employee identities. To simplify cross-account access, the security team is implementing direct SAML federation to each member account, allowing developers to federate directly into roles. However, during initial testing, users receive an Access Denied error after authenticating at the IdP redirect page. Simultaneously, the security team needs to ensure that no developer role can modify security logging configurations, regardless of any local IAM permissions or administrator privileges.

Which combinations of actions will resolve the federation issue and enforce the logging restriction? (Select TWO.)

  1. Modify the trust policy of the IAM roles in the member accounts to ensure the principal is the SAML provider metadata ARN and the Action is set to sts:AssumeRoleWithSAML.Answer
  2. Create a Service Control Policy (SCP) with an explicit Deny rule for the logging modifications and attach it to the target Organizational Units (OUs).Answer
  3. C
    Modify the trust policy of the IAM roles in the member accounts to trust the external IdP domain name as a principal and allow the sts:AssumeRoleWithWebIdentity action.
  4. D
    Apply a Service Control Policy (SCP) to the member accounts that explicitly allows the federated roles to perform actions and relies on the SCP to grant the permissions without local IAM policies.
  5. E
    Configure the SAML assertion attributes in the external IdP to pass the IAM role ARN as the Subject identifier (NameID) and specify the sts:AssumeRole action in the audience restriction.

Answer

To resolve the federation issue, modify the trust policy of the IAM roles in the member accounts to trust the SAML provider metadata ARN and allow the sts:AssumeRoleWithSAML action. To enforce the logging restriction, apply a Service Control Policy (SCP) with an explicit Deny rule for the logging modifications to the target Organizational Units (OUs).
For SAML 2.0-based federation, the target IAM roles in the member accounts must trust the SAML provider ARN and allow the sts:AssumeRoleWithSAML action. To restrict logging modifications across all accounts regardless of local IAM or administrator permissions, a Service Control Policy (SCP) with an explicit Deny statement must be applied, as SCP Deny statements override any local permissions.

Step-by-Step Solution

1
Diagnose the SAML federation Access Denied error.
Identify that the IAM roles in the member accounts must trust the SAML Identity Provider (IdP) principal and use the correct STS action.
SAML 2.0 federation requires target roles to have a trust policy allowing the sts:AssumeRoleWithSAML action from the SAML provider principal.
2
Configure the trust policy of the target IAM roles in member accounts.
Update the IAM role trust policies to explicitly allow the sts:AssumeRoleWithSAML action for the SAML provider ARN.
This establishes the cryptographic trust relationship necessary for external users to authenticate and federate into target roles.
3
Implement global administrative guardrails for logging configuration.
Draft a Service Control Policy (SCP) containing an explicit Deny statement for security logging modifications, and attach it to the appropriate OUs.
SCPs act as organizational guardrails that filter permissions across all member accounts, and an explicit Deny cannot be overridden by local administrators.

Key Concept

Multi-Account SAML 2.0 federation requires the target IAM roles to trust the SAML provider ARN with the sts:AssumeRoleWithSAML action. Service Control Policies (SCPs) serve as guardrails to enforce organization-wide restrictions but do not grant permissions directly.
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic