A company manages its multi-account AWS environment using AWS Organizations. A solutions architect is configuring SAML 2.0-based federation with an external Identity Provider (IdP) to allow database administrators to log in directly to a target production account (111122223333) and manage Amazon RDS databases.
The solutions architect creates an IAM role named `DBA-Federated-Role` and configures its trust policy as follows:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Federated": "arn:aws:iam::111122223333:saml-provider/Corporate-IdP"
},
"Action": "sts:AssumeRole",
"Condition": {
"StringEquals": {
"SAML:aud": "https://signin.aws.amazon.com/saml"
}
}
}
]
}
To control permissions centrally, the solutions architect attaches a Service Control Policy (SCP) to the Production Organizational Unit (OU) that contains the production account. The SCP contains an `Allow` statement for all Amazon RDS actions (`rds:*`). No identity-based permission policies are attached directly to the `DBA-Federated-Role`.
When database administrators attempt to log in using the corporate identity provider portal, the federation fails and they cannot assume the role.
Which combination of actions must the solutions architect take to resolve the federation failure and ensure the database administrators have the necessary permissions to manage the RDS databases?
- Change the action in the trust policy of the IAM role to `sts:AssumeRoleWithSAML`, and attach an identity-based IAM policy to the role in the target production account that explicitly allows the required Amazon RDS actions.Answer
- BChange the action in the trust policy of the IAM role to `sts:AssumeRoleWithSAML`. No local IAM policies are required because the Service Control Policy (SCP) attached to the Organizational Unit (OU) explicitly allows the RDS actions, which automatically grants the permissions to all authenticated principals in the member accounts.
- CModify the trust policy of the IAM role to use `sts:AssumeRole` with the SAML provider as a service principal, and attach an identity-based IAM policy to the role in the target production account that explicitly allows the required Amazon RDS actions.
- DChange the action in the trust policy of the IAM role to `sts:AssumeRoleWithWebIdentity`, and attach an identity-based IAM policy to the role in the target production account that explicitly allows the required Amazon RDS actions.