Examkin

Question

Difficulty: HardMulti-Account Identity and Access Management Federation

A logistics company is designing a multi-account AWS environment under AWS Organizations. The security team must configure single sign-on access for 200200 system administrators using the company's on-premises Active Directory Federation Services (AD FS) as the SAML 2.02.0 Identity Provider (IdP). The administrators must be able to log in to the AWS Management Console with their existing corporate credentials and assume roles in various AWS member accounts based on their Active Directory group memberships.

Which combination of actions must the solutions architect take to establish this federated access? (Select TWO.)

  1. Create a SAML Identity Provider entity in each member account using the AD FS federation metadata document, and create IAM roles with a trust policy that allows the 'sts:AssumeRoleWithSAML' action for the SAML provider principal.Answer
  2. Configure the AD FS assertion claims to output the 'https://aws.amazon.com/SAML/Attributes/Role' attribute mapping the user's Active Directory groups to the IAM role and SAML provider ARNs, along with the 'RoleSessionName' attribute.Answer
  3. C
    Create a single SAML Identity Provider entity in the management account of the organization, and attach a Service Control Policy (SCP) to the root OU to delegate federation access to the member accounts.
  4. D
    Create a SAML Identity Provider entity in each member account, and create target IAM roles with a trust policy that allows the 'sts:AssumeRole' action for the SAML identity provider principal.

Answer

Configure a SAML Identity Provider entity in each member account with a trust policy allowing 'sts:AssumeRoleWithSAML', and configure AD FS claims to output the AWS-required SAML attributes mapped to the correct ARNs.
Establishing SAML federation requires configuring both the AWS side (creating the SAML provider and a trust policy that allows 'sts:AssumeRoleWithSAML') and the IdP side (mapping the user group to release the correct SAML attributes, specifically the Role and RoleSessionName attributes).

Step-by-Step Solution

1
Establish trust on the AWS side by creating a SAML provider in each member account and defining IAM roles that reference this provider.
IAM roles in member accounts contain trust policies targeting the SAML provider ARN with the 'sts:AssumeRoleWithSAML' action.
This enables AWS STS to accept SAML assertions from the IDP for assuming these specific roles.
2
Configure assertion mapping on the identity provider (AD FS) side.
The identity provider outputs SAML assertions containing the 'Role' attribute (mapping to the role and provider ARNs) and 'RoleSessionName'.
AWS requires these specific SAML attributes in the assertion to map the federated user to the correct target role.

Key Concept

SAML 2.0 federation trust configuration and attribute mapping in a multi-account AWS environment
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic