Examkin

Question

Difficulty: MediumMulti-Account Identity and Access Management Federation

A retail corporation has configured a multi-account AWS environment using AWS Organizations. The security team is setting up federated single sign-on (SSO) using an on-premises SAML 2.0-compliant Identity Provider (IdP). The solutions architect needs to configure the IAM roles in the member accounts to trust the SAML IdP. When external users attempt to log in through the IdP portal, they receive access denied errors before they can select a role. Which of the following configurations must the solutions architect apply to the IAM roles in the target member accounts to successfully establish the trust relationship?

  1. A
    Configure the IAM role trust policy to specify the SAML provider ARN as the Principal, and set the Action to sts:AssumeRole.
  2. Configure the IAM role trust policy to specify the SAML provider ARN as the Principal, and set the Action to sts:AssumeRoleWithSAML.Answer
  3. C
    Attach a Service Control Policy (SCP) to the target member accounts that allows the sts:AssumeRoleWithSAML action for the SAML provider ARN.
  4. D
    Configure the IAM role trust policy to trust the SAML provider ARN, and configure the default AWS-managed KMS key (aws/iam) in the target account to allow decryption of the SAML assertion.

Answer

Configure the IAM role trust policy to specify the SAML provider ARN as the Principal, and set the Action to sts:AssumeRoleWithSAML.
The correct configuration establishes a direct trust relationship between the IAM role in the member account and the SAML Identity Provider. This is achieved by specifying the SAML provider's ARN as the Principal and setting the Action to sts:AssumeRoleWithSAML in the role's trust policy. This action permits AWS STS to return temporary security credentials to users authenticated by the external IdP.

Step-by-Step Solution

1
Identify the authentication flow requirement.
The authentication flow uses SAML 2.0 federation from an external Identity Provider (IdP) to access target AWS accounts.
This requires the Security Token Service (STS) to validate SAML assertions and issue temporary security credentials.
2
Determine the correct API action for SAML-based federation.
The correct API action is sts:AssumeRoleWithSAML.
Unlike standard role assumption (sts:AssumeRole) which is used for IAM users or cross-account roles, sts:AssumeRoleWithSAML is specifically designed for SAML 2.0 identity federation.
3
Configure the trust relationship policy on the target IAM roles.
The trust policy specifies the SAML Identity Provider's ARN as the Principal and allows the Action sts:AssumeRoleWithSAML.
This establishes the necessary trust relationship, allowing federated users to successfully assume the target roles.

Key Concept

SAML 2.0 federation requires the sts:AssumeRoleWithSAML action in the IAM role's trust policy.
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic