Examkin

Question

Difficulty: HardMulti-Account Identity and Access Management Federation

An enterprise manages its multi-account environment using AWS Organizations. The security team is implementing federated access using an on-premises SAML 2.0-compliant Identity Provider (IdP) to allow corporate users to access the AWS Management Console and AWS CLI across member accounts. A Service Control Policy (SCP) is applied at the organization root to restrict all operations to the eu−central−1eu-central-1 and eu−west−1eu-west-1 regions. However, during testing, federated users receive access denied errors when attempting to authenticate and assume roles in any member account.

Which of the following configuration steps must be performed to successfully establish federated access and resolve the authentication issues? (Select TWO.)

  1. Configure the IAM role trust policy in each member account to allow the sts:AssumeRoleWithSAML action for the SAML identity provider principal.Answer
  2. B
    Configure the IAM role trust policy in each member account to allow the sts:AssumeRole action and specify the SAML identity provider ARN as the principal.
  3. Modify the regional restriction SCP to exclude the Security Token Service (STS) endpoint from the restriction, allowing users to authenticate via the global STS endpoint.Answer
  4. D
    Update the regional restriction SCP to explicitly allow sts:AssumeRoleWithSAML actions for the federated users, since SCPs inherit permissions down the organizational hierarchy.
  5. E
    Create an OpenID Connect (OIDC) identity provider in each member account referencing the SAML metadata document and update the role trust policy to allow the sts:AssumeRoleWithWebIdentity action.

Answer

To establish federated access, the IAM roles in the member accounts must trust the SAML identity provider using the sts:AssumeRoleWithSAML action, and the regional restriction SCP must exempt the global STS service from its deny conditions to allow authentication requests to succeed.
Establishing direct SAML federation requires configuring the IAM role trust policy in each member account to permit the sts:AssumeRoleWithSAML action for the SAML identity provider principal. Additionally, because the SAML login process relies on the global STS endpoint, any SCP that restricts actions by region must specifically exempt STS so that the authentication request can be processed.

Step-by-Step Solution

1
Establish the trust relationship in the IAM roles.
The IAM role trust policy in each member account is updated to define the SAML provider as the principal and allow the sts:AssumeRoleWithSAML action.
This configuration is required by AWS IAM to successfully authenticate users and return temporary credentials when exchanging the SAML assertion.
2
Add an exemption to the regional restriction Service Control Policy (SCP).
The SCP at the organization root is updated with a condition that excludes the Security Token Service (STS) from the global deny block.
Because the default SAML login endpoint redirects to the global STS service (which resolves to us-east-1), a regional SCP that restricts operations to specific European regions will block the authentication traffic unless STS is explicitly exempted.

Key Concept

Configuring SAML 2.0 federation and accommodating global services within regional restriction SCPs.
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic