Examkin

Question

Difficulty: MediumMulti-Account Identity and Access Management Federation

An enterprise is configuring identity federation using an on-premises SAML 2.0 Identity Provider (IdP) to allow database administrators to access multiple member accounts in AWS Organizations. The administrators must assume an IAM role named DB-Admin-Role in the target member accounts after authenticating. During initial testing, administrators receive an Access Denied error immediately when attempting to federate from the identity provider portal. A solutions architect reviews the trust policy configured for the DB-Admin-Role:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Federated": "arn:aws:iam::123456789012:saml-provider/ADFS-IdP"
},
"Action": "sts:AssumeRole",
"Condition": {
"StringEquals": {
"SAML:aud": "https://signin.aws.amazon.com/saml"
}
}
}
]
}

Which of the following modifications to the trust policy will resolve this issue?

  1. Change the Action in the trust policy from sts:AssumeRole to sts:AssumeRoleWithSAML.Answer
  2. B
    Change the Action in the trust policy from sts:AssumeRole to sts:AssumeRoleWithWebIdentity.
  3. C
    Change the Federated principal to the account root ARN and move the SAML provider configuration to a conditional check.
  4. D
    Attach a Service Control Policy (SCP) at the root level of the organization that explicitly allows the sts:AssumeRole action for the SAML provider.

Answer

Change the Action in the trust policy from sts:AssumeRole to sts:AssumeRoleWithSAML.
The correct solution is to change the Action in the trust policy to sts:AssumeRoleWithSAML. When a federated user logs in via an enterprise SAML Identity Provider (IdP) portal, the browser receives a SAML assertion and sends it to the AWS SAML endpoint. AWS validates the assertion and calls the sts:AssumeRoleWithSAML API to obtain temporary credentials for the role. If the trust policy only permits sts:AssumeRole, the API call fails with an Access Denied error.

Step-by-Step Solution

1
Analyze the IAM role trust policy and identify the federation mechanism.
The configuration uses a Federated principal pointing to a SAML provider, which indicates SAML 2.0 federation.
Recognizing the identity provider type dictates which STS API call must be allowed in the trust policy action.
2
Compare the configured STS action with the required action for SAML federation.
The policy currently uses sts:AssumeRole, which requires AWS principal authentication, whereas SAML federation requires sts:AssumeRoleWithSAML.
Exchanging a SAML assertion for temporary credentials requires calling the AssumeRoleWithSAML API endpoint.
3
Determine the correct modification to resolve the authentication error.
Change the Action to sts:AssumeRoleWithSAML.
This matches the API call made by the AWS Sign-In endpoint when users authenticate via the identity provider portal.

Key Concept

SAML 2.0 Identity Federation Trust Policies
Estimated Time:1m 30s
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic