An organization wants to configure federated single sign-on (SSO) to allow corporate users to access the AWS Management Console using their existing on-premises SAML 2.0 compliant Identity Provider (IdP). To establish this trust relationship, which of the following configuration steps must be performed within AWS Identity and Access Management (IAM)? (Select TWO.)
- Create an IAM SAML identity provider entity by uploading the SAML metadata document obtained from the on-premises IdP.Answer
- Create an IAM role for SAML 2.0 federation with a trust policy that allows the sts:AssumeRoleWithSAML action and designates the SAML provider as the principal.Answer
- CCreate an IAM role with a trust policy that permits the sts:AssumeRole action and designates the external SAML provider as the principal.
- DCreate a Service Control Policy (SCP) at the root level of the AWS Organization to grant console access to the external SAML provider.
Answer
To configure SAML 2.0 single sign-on (SSO) in AWS, you must create a SAML identity provider in IAM using the IdP's metadata document, and create an IAM role for SAML 2.0 federation with a trust policy that permits the sts:AssumeRoleWithSAML action.
The correct options are creating an IAM SAML identity provider using the IdP metadata document and configuring an IAM role with a trust policy that permits the sts:AssumeRoleWithSAML action. Together, these configurations establish trust and allow federated users to gain temporary access to AWS resources using SAML assertions.
Step-by-Step Solution
Key Concept
SAML 2.0 identity federation configuration in AWS IAM