Examkin

Question

Difficulty: MediumMulti-Account Identity and Access Management Federation

An enterprise is implementing a multi-account strategy using AWS Organizations. The solutions architect is setting up SAML 2.0-based federation to allow users from the corporate identity provider (IdP) to access resources in the target member accounts. Which of the following configurations are required to successfully establish this federated access? (Select TWO.)

  1. In each target AWS account, create an IAM role with a trust policy that specifies the SAML provider's ARN as the federated principal and allows the sts:AssumeRoleWithSAML action.Answer
  2. Configure the identity provider (IdP) to include a SAML attribute named https://aws.amazon.com/SAML/Attributes/Role that specifies the ARN of the IAM role and the ARN of the SAML provider.Answer
  3. C
    Attach a Service Control Policy (SCP) at the organizational unit (OU) level that grants the sts:AssumeRoleWithSAML action to the identity provider principal.
  4. D
    In each target AWS account, create an IAM role with a trust policy that allows the sts:AssumeRole action and specifies the AWS Organization ID as the principal.
  5. E
    Configure the identity provider (IdP) to include a SAML attribute named https://aws.amazon.com/SAML/Attributes/RoleSessionName that matches the Organization ID.

Answer

To configure SAML 2.0-based federation across multiple AWS accounts, you must create an IAM role in each target account with a trust policy allowing the sts:AssumeRoleWithSAML action from the SAML provider principal. Additionally, the identity provider must send a SAML assertion containing the role and provider ARNs mapped to the https://aws.amazon.com/SAML/Attributes/Role attribute.
Establishing federated access via SAML 2.0 requires configuration on both the Identity Provider (IdP) side and the AWS side. On the AWS side, each target account must have an IAM role whose trust policy designates the SAML provider as the trusted federated principal and permits the sts:AssumeRoleWithSAML action. On the IdP side, the assertion must include the specific role attribute mapping containing both the target IAM role ARN and the SAML provider ARN.

Step-by-Step Solution

1
Configure the trust relationship on the target IAM role in the destination AWS account.
An IAM role is created with a trust policy pointing to the SAML provider ARN as the federated principal and allowing the sts:AssumeRoleWithSAML action.
This establishes the necessary trust relationship in the target account so AWS Security Token Service (STS) can validate and issue federated credentials.
2
Configure SAML assertions and attribute mappings within the corporate Identity Provider (IdP).
The IdP outputs SAML assertions containing the required attributes, specifically https://aws.amazon.com/SAML/Attributes/Role (mapping user groups to target IAM roles and providers) and https://aws.amazon.com/SAML/Attributes/RoleSessionName.
AWS Sign-In relies on these attributes to map the incoming federated user to the correct IAM role and identity provider pair.

Key Concept

Multi-Account SAML 2.0 federation requires establishing trust on the destination IAM role using sts:AssumeRoleWithSAML and passing the target role and provider ARNs in the SAML assertion.
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic