Examkin

Question

Difficulty: EasyMulti-Account Identity and Access Management Federation

A solutions architect is configuring single sign-on access to a member account within AWS Organizations. The architect establishes a trust relationship with an external SAML 2.0 Identity Provider (IdP) by creating an IAM identity provider in the member account. However, when corporate directory users attempt to federate, the authentication flow fails when trying to assume the designated target role.

Which of the following represents the correct configuration required in the target IAM role's trust policy to resolve this issue?

  1. Configure the IAM role trust policy to define the SAML identity provider as the principal and allow the sts:AssumeRoleWithSAML action.Answer
  2. B
    Configure the IAM role trust policy to define the corporate user directory as the principal and allow the sts:AssumeRole action.
  3. C
    Attach a Service Control Policy to the organizational unit that explicitly allows the sts:AssumeRoleWithSAML action for external identity providers.
  4. D
    Configure the IAM role trust policy to define the SAML identity provider as the principal and allow the sts:AssumeRoleWithWebIdentity action.

Answer

Configure the IAM role trust policy to define the SAML identity provider as the principal and allow the sts:AssumeRoleWithSAML action.
The configuration that defines the SAML identity provider as the principal and allows the sts:AssumeRoleWithSAML action is correct. This is because AWS STS requires this specific API action to exchange a SAML assertion for temporary credentials, and the IAM role's trust policy must specify the IAM SAML identity provider as the trusted principal.

Step-by-Step Solution

1
Identify the federation protocol being configured.
The federation protocol is SAML 2.0.
The scenario specifies that the trust relationship is established with a SAML 2.0 Identity Provider (IdP).
2
Determine the correct AWS Security Token Service (STS) action for SAML 2.0.
The correct action is sts:AssumeRoleWithSAML.
AWS Security Token Service requires the sts:AssumeRoleWithSAML API action to process SAML assertions and issue temporary security credentials.
3
Formulate the trust relationship policy document for the target IAM role.
Create a trust policy with the Principal pointing to the SAML provider ARN and the Action set to sts:AssumeRoleWithSAML.
The IAM role must explicitly trust the SAML identity provider as a principal and allow the correct STS action to authorize the federation request.

Key Concept

SAML 2.0 Federation Trust Policy Configuration
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic