Question

Difficulty: HardMulti-Account Identity and Access Management Federation

A company manages its multi-account AWS environment using AWS Organizations. A solutions architect is configuring SAML 2.0-based federation with an external Identity Provider (IdP) to allow database administrators to log in directly to a target production account (111122223333) and manage Amazon RDS databases.

The solutions architect creates an IAM role named `DBA-Federated-Role` and configures its trust policy as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Federated": "arn:aws:iam::111122223333:saml-provider/Corporate-IdP"
},
"Action": "sts:AssumeRole",
"Condition": {
"StringEquals": {
"SAML:aud": "https://signin.aws.amazon.com/saml"
}
}
}
]
}

To control permissions centrally, the solutions architect attaches a Service Control Policy (SCP) to the Production Organizational Unit (OU) that contains the production account. The SCP contains an `Allow` statement for all Amazon RDS actions (`rds:*`). No identity-based permission policies are attached directly to the `DBA-Federated-Role`.

When database administrators attempt to log in using the corporate identity provider portal, the federation fails and they cannot assume the role.

Which combination of actions must the solutions architect take to resolve the federation failure and ensure the database administrators have the necessary permissions to manage the RDS databases?

  1. Change the action in the trust policy of the IAM role to `sts:AssumeRoleWithSAML`, and attach an identity-based IAM policy to the role in the target production account that explicitly allows the required Amazon RDS actions.Answer
  2. B
    Change the action in the trust policy of the IAM role to `sts:AssumeRoleWithSAML`. No local IAM policies are required because the Service Control Policy (SCP) attached to the Organizational Unit (OU) explicitly allows the RDS actions, which automatically grants the permissions to all authenticated principals in the member accounts.
  3. C
    Modify the trust policy of the IAM role to use `sts:AssumeRole` with the SAML provider as a service principal, and attach an identity-based IAM policy to the role in the target production account that explicitly allows the required Amazon RDS actions.
  4. D
    Change the action in the trust policy of the IAM role to `sts:AssumeRoleWithWebIdentity`, and attach an identity-based IAM policy to the role in the target production account that explicitly allows the required Amazon RDS actions.

Answer

Change the action in the trust policy of the IAM role to `sts:AssumeRoleWithSAML`, and attach an identity-based IAM policy to the role in the target production account that explicitly allows the required Amazon RDS actions.
The correct answer updates the trust policy action to `sts:AssumeRoleWithSAML` which is required for SAML-based federation, and attaches an identity-based IAM policy to the federated role. In AWS Organizations, Service Control Policies (SCPs) set permission guardrails but do not grant permissions directly. Therefore, local identity-based policies must be used to grant access.

Step-by-Step Solution

1
Analyze the IAM trust policy action configuration for external SAML 2.0 federation.
Determine that the trust policy must use `sts:AssumeRoleWithSAML` as its action.
When federating via a SAML IdP, the user client requests temporary security credentials by calling the AWS STS `AssumeRoleWithSAML` API. The default `sts:AssumeRole` is meant for IAM users, cross-account access, or AWS services, not SAML federation.
2
Evaluate the role of Service Control Policies (SCPs) versus identity-based policies in AWS Organizations.
Identify that an identity-based IAM policy allowing `rds:*` must be attached directly to the `DBA-Federated-Role` role.
SCPs act as boundaries (guardrails) that restrict the maximum permissions available to accounts within an OU. They do not grant permissions to IAM roles or users. Without a local identity-based policy, the federated user has an implicit deny for all actions.

Key Concept

SAML 2.0 federation requires the `sts:AssumeRoleWithSAML` action in the trust policy, and Service Control Policies (SCPs) function as permission filters rather than granting permissions directly.
Estimated Time:2m 0s
Rate this question