Examkin

Question

Difficulty: MediumMulti-Account Identity and Access Management Federation

An enterprise is centralizing its multi-account access management using AWS IAM Identity Center. The company wants to federate identities from an external SAML 2.0 identity provider (IdP) and ensure that user accounts and group memberships are automatically synchronized from the IdP. Which of the following configuration steps must be performed to establish this integration? (Select TWO.)

  1. Configure SAML 2.0 federation in AWS IAM Identity Center by exchanging metadata files between the IdP and AWS, and then enable and configure System for Cross-domain Identity Management (SCIM) in AWS IAM Identity Center and the IdP.Answer
  2. Create permission sets in AWS IAM Identity Center to define access levels, and assign these permission sets to the synchronized groups and users for the target AWS accounts in the AWS Organization.Answer
  3. C
    Define a Service Control Policy (SCP) at the root level of AWS Organizations to grant access to the synchronized groups, allowing member accounts to inherit access permissions automatically.
  4. D
    In each target AWS account, configure a custom IAM role with a trust policy that specifies the IdP as the principal and allows the 'sts:AssumeRole' action, then assign this role directly to the external directory groups.

Answer

Configuring SAML 2.0 federation and SCIM in AWS IAM Identity Center, and creating permission sets to assign to synchronized groups in the target accounts.
To establish federated access and automated user/group provisioning using AWS IAM Identity Center, the solutions architect must configure SAML 2.0 federation (by exchanging metadata between AWS and the IdP) and enable SCIM. The SCIM endpoint and access token allow the IdP to push identity synchronization. Furthermore, the administrator must define permission sets in AWS IAM Identity Center and assign them to the synchronized users or groups for the specific target AWS accounts.

Step-by-Step Solution

1
Establish federation and synchronization between the external identity provider (IdP) and AWS IAM Identity Center.
SAML 2.0 authentication is enabled, and users/groups are provisioned automatically via SCIM.
AWS IAM Identity Center requires metadata exchange for authentication and SCIM for automated user/group provisioning.
2
Create and assign permission sets in AWS IAM Identity Center.
Synchronized users and groups are granted specific access levels in target AWS accounts.
Permission sets are the mechanism by which AWS IAM Identity Center maps access rights to users in specific accounts.

Key Concept

Centralized multi-account identity federation and provisioning using AWS IAM Identity Center and SCIM.
Estimated Time:2m 0s
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic