Examkin

Question

Difficulty: HardSecurity and Compliance Control Design

A global pharmaceutical corporation is building a multi-tenant clinical analytics platform on AWS. The platform allows external clinical research organizations (CROs) to upload sensitive clinical trial data directly into Amazon S3 buckets. The corporation uses an external SAML 2.0 compliant identity provider (IdP) to manage external researcher identities. To comply with strict data protection regulations, the solutions architect must design a secure federation solution. The design must ensure that external researchers can only assume their assigned IAM roles in the member accounts if the external IdP has validated their session using multi-factor authentication (MFA). Furthermore, to prevent accidental or malicious modification of these security configurations, local administrators in the member accounts must not be able to delete or modify the federated IAM roles or the SAML provider configuration. Which two actions should the solutions architect recommend to meet these requirements? (Select two.)

  1. Configure the trust policy of the IAM roles in the member accounts with the principal set to the SAML provider ARN, specify the sts:AssumeRoleWithSAML action, and add a condition checking that the saml:AuthnMethodsReferences key contains the multi-factor authentication (MFA) context class reference.Answer
  2. Apply a Service Control Policy (SCP) at the Organizational Unit (OU) level containing the member accounts that denies the iam:DeleteRole, iam:UpdateRole, and iam:DeleteSAMLProvider actions when the resource matches the specific federated IAM roles and SAML provider ARNs.Answer
  3. C
    Configure the trust policy of the IAM roles in the member accounts using the sts:AssumeRole action and specify the SAML identity provider ARN as the Principal.
  4. D
    Apply a Service Control Policy (SCP) at the Organizational Unit (OU) level containing the member accounts that explicitly allows the sts:AssumeRoleWithSAML action for the SAML identity provider to grant access to the federated IAM roles without requiring local trust policies.
  5. E
    Configure the trust policy of the IAM roles in the member accounts to trust the AWS-managed KMS key for Amazon S3 (aws/s3) to verify the digital signature of the SAML assertions and authorize the federated session.

Answer

Configure the trust policy of the IAM roles in the member accounts with the principal set to the SAML provider ARN, specifying the sts:AssumeRoleWithSAML action, and adding a condition checking that the saml:AuthnMethodsReferences key contains the multi-factor authentication (MFA) context class reference; and apply a Service Control Policy (SCP) at the Organizational Unit (OU) level containing the member accounts that denies the iam:DeleteRole, iam:UpdateRole, and iam:DeleteSAMLProvider actions when the resource matches the specific federated IAM roles and SAML provider ARNs.
The correct options are configuring the trust policy with the principal set to the SAML provider ARN using the sts:AssumeRoleWithSAML action and verifying MFA with the saml:AuthnMethodsReferences key; and applying a Service Control Policy (SCP) at the OU level that denies deletion and updates of the federated IAM roles and SAML provider configurations. The trust policy configuration correctly handles SAML-based role assumption and validates that MFA was performed by the IdP. The SCP ensures that administrative users in the member accounts cannot bypass or delete these critical security controls.

Step-by-Step Solution

1
Configure SAML federation trust policies
The IAM roles in the member accounts are configured to trust the SAML identity provider ARN, use the correct federation action, and validate the MFA status via the saml:AuthnMethodsReferences context key.
This establishes a secure trust relationship with the external identity provider and ensures that only sessions verified with MFA can assume the role.
2
Enforce control guardrails across member accounts using SCPs
An SCP is applied at the OU level to deny update and delete operations on the federated roles and SAML provider configurations.
This prevents local administrators in the member accounts from bypassing compliance controls or tampering with the federation configuration.

Key Concept

Designing secure cross-account identity federation and organizational guardrails using SAML 2.0 and Service Control Policies (SCPs).
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic