A company is configuring passwordless deployment pipelines from an external, OpenID Connect (OIDC)-compliant CI/CD platform to deploy application stacks across multiple member accounts in AWS Organizations. Each pipeline must be able to assume a deployment role in its respective target member account. Which of the following configurations are required to establish the trust relationship and enable this federated access? (Select TWO.)
- Configure an IAM OIDC identity provider in each target member account, specifying the external CI/CD provider's issuer URL and the configured audience (client ID).Answer
- In each target member account, create an IAM role with a trust policy that allows the sts:AssumeRoleWithWebIdentity action and includes conditions restricting access based on OIDC claim parameters.Answer
- CIn each target member account, create an IAM role with a trust policy that allows the sts:AssumeRole action, referencing the external CI/CD provider's URL as the trust principal.
- DAttach a Service Control Policy (SCP) to the target Organizational Unit (OU) that explicitly grants sts:AssumeRoleWithWebIdentity permissions to the external CI/CD provider's URL.
Answer
To establish federated OIDC access, you must configure an IAM OIDC identity provider in each member account with the provider's URL and client ID, and then create an IAM role in each member account with a trust policy that allows the sts:AssumeRoleWithWebIdentity action and validates specific OIDC claims.
Establishing web identity federation with an OIDC provider requires registering the provider in IAM using its issuer URL and audience (client ID). To assume the roles, the trust policy must explicitly allow the 'sts:AssumeRoleWithWebIdentity' action, which allows the external client to exchange its OIDC token for temporary AWS credentials. Restricting access using conditions (like audience or subject) ensures that only the specified external pipelines can assume the role.
Step-by-Step Solution
Key Concept
OIDC Federation and Role Trust Policies