Examkin

Question

Difficulty: MediumMulti-Account Identity and Access Management Federation

A company is implementing federated access to multiple AWS accounts within an AWS Organization using a third-party SAML 2.0 compliant corporate Identity Provider (IdP). Employees must be able to log in to the AWS Management Console using their corporate credentials and assume specific roles based on their Active Directory group memberships. Which of the following configurations are required to establish this federation and trust relationship? (Select TWO.)

  1. Create an IAM SAML identity provider in each target AWS account using the metadata document from the corporate Identity Provider, and create IAM roles with a trust policy that allows the sts:AssumeRoleWithSAML action.Answer
  2. Configure the corporate Identity Provider to include attributes in the SAML assertion that map the user to the target IAM role ARN and the SAML provider ARN.Answer
  3. C
    Create an IAM role in each target AWS account with a trust policy that permits the sts:AssumeRole action and lists the corporate Identity Provider as the principal.
  4. D
    Configure a Service Control Policy (SCP) at the root of the AWS Organization to grant sts:AssumeRoleWithSAML permissions directly to the corporate Identity Provider endpoint.

Answer

The configurations required are creating an IAM SAML identity provider in each target account with a trust policy allowing the sts:AssumeRoleWithSAML action, and configuring the corporate IdP to send SAML assertions mapping the user to the target IAM role ARN and SAML provider ARN.
Establishing SAML 2.0 federation requires the creation of an IAM identity provider entity in target accounts linked with the IdP's metadata document. Additionally, roles must be defined with trust policies that allow the sts:AssumeRoleWithSAML action. Simultaneously, the corporate IdP must be configured to pass the appropriate SAML attributes (specifically mapped IAM role and SAML provider ARNs) inside the assertion for AWS to complete the sign-in sequence.

Step-by-Step Solution

1
Generate and export the SAML metadata document from the corporate Identity Provider (IdP).
An XML file containing the cryptographic keys and endpoints for the IdP.
This metadata is necessary to establish the cryptographic trust relationship in AWS.
2
Create an IAM SAML Identity Provider in each target AWS account using the metadata XML, and define target IAM roles with trust policies specifying the sts:AssumeRoleWithSAML action.
Target IAM roles are configured to trust assertions from the corporate IdP.
This allows the sts:AssumeRoleWithSAML action to be invoked when a valid SAML assertion is presented.
3
Configure claims and attribute mappings in the corporate IdP to output the Role and RoleSessionName attributes in the SAML assertion.
SAML assertions carry the required AWS attributes mapping to the target IAM role and provider ARNs.
AWS uses these specific attributes to identify which role the federated user is authorized to assume.

Key Concept

Establishment of SAML 2.0 federation in a multi-account environment requires both an IAM SAML provider with a matching trust policy in target accounts and proper attribute configuration in the corporate IdP.
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic