Examkin

Question

Difficulty: EasyMulti-Account Identity and Access Management Federation

A company is setting up federated single sign-on (SSO) using a SAML 2.0 compliant corporate identity provider (IdP). They have already created the SAML identity provider entity in AWS IAM. To allow corporate users to federate into the AWS account, they need to create an IAM role. What must be configured in the trust policy of this IAM role to allow successful federation?

  1. Specify the SAML identity provider as the principal and allow the sts:AssumeRoleWithSAML action.Answer
  2. B
    Specify the SAML identity provider as the principal and allow the sts:AssumeRole action.
  3. C
    Specify the SAML identity provider as the principal and allow the sts:AssumeRoleWithWebIdentity action.
  4. D
    Configure an Organization-level Service Control Policy (SCP) to grant permission for the corporate directory to assume roles across all accounts.

Answer

Specify the SAML identity provider as the principal and allow the sts:AssumeRoleWithSAML action.
The correct answer specifies mapping the SAML identity provider as the principal and allowing the sts:AssumeRoleWithSAML action because the AWS Security Token Service (STS) requires this specific API action to handle assertions generated by a SAML 2.0-compliant Identity Provider (IdP).

Step-by-Step Solution

1
Identify the type of federation required.
The scenario specifies SAML 2.0 compliant corporate identity provider (IdP) federation.
This determines which security token service (STS) API action must be allowed.
2
Determine the correct STS API action for SAML 2.0.
The correct action is sts:AssumeRoleWithSAML.
SAML assertion exchanges require the specific WithSAML variation of the assume role API.
3
Determine the required trust policy components.
The Principal must target the ARN of the IAM SAML Identity Provider entity, and the Action must be sts:AssumeRoleWithSAML.
An IAM role must explicitly define who (the Principal) is trusted to assume it and under what action.

Key Concept

SAML 2.0 Identity Federation Trust Relationships
Estimated Time:45s
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic