Examkin

Question

Difficulty: HardMulti-Account Identity and Access Management Federation

An enterprise is establishing direct federated access for its operations team to a Shared Services AWS account (account ID 111122223333) using an on-premises SAML 2.0-compliant Identity Provider (IdP). A Solutions Architect creates a SAML provider named 'CorporateIdP' and an IAM role named 'OpsConsoleRole' in the Shared Services account.

During testing, users receive an error message in their browser stating: 'Your request to assume a role has been denied' when redirecting from the IdP portal. The trust policy of the 'OpsConsoleRole' is currently configured as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Federated": "arn:aws:iam::111122223333:saml-provider/CorporateIdP"
},
"Action": "sts:AssumeRole",
"Condition": {
"StringEquals": {
"SAML:aud": "https://signin.aws.amazon.com/saml"
}
}
}
]
}

Additionally, a Service Control Policy (SCP) is attached to the organizational unit (OU) containing the Shared Services account:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"sts:AssumeRole",
"sts:AssumeRoleWithSAML"
],
"Resource": "*"
}
]
}

Which of the following actions should the Solutions Architect take to resolve the authentication error and successfully establish federated access? (Select TWO.)

  1. Change the Action in the trust policy of the 'OpsConsoleRole' IAM role from 'sts:AssumeRole' to 'sts:AssumeRoleWithSAML'.Answer
  2. Configure the SAML assertion sent by the Identity Provider to include the 'https://aws.amazon.com/SAML/Attributes/Role' attribute with the ARNs of both the IAM role and the SAML provider.Answer
  3. C
    Modify the Service Control Policy (SCP) to explicitly grant permissions to the 'CorporateIdP' SAML provider, as SCPs must authorize external federated principals.
  4. D
    Configure the Principal in the trust policy of the IAM role to trust the AWS account root 'arn:aws:iam::111122223333:root' instead of the SAML provider.
  5. E
    Remove the trust policy from the 'OpsConsoleRole' IAM role entirely, relying on the SCP attached to the OU to grant the required 'sts:AssumeRoleWithSAML' permissions.

Answer

Change the Action in the trust policy of the IAM role to 'sts:AssumeRoleWithSAML' and ensure the Identity Provider's SAML assertion contains the 'https://aws.amazon.com/SAML/Attributes/Role' attribute with both the role and provider ARNs.
For SAML 2.0 identity federation to succeed in AWS, two conditions must be met: the IAM role's trust policy must trust the SAML provider and specify the 'sts:AssumeRoleWithSAML' action, and the external Identity Provider must include mandatory SAML attributes, specifically the 'https://aws.amazon.com/SAML/Attributes/Role' attribute containing the ARNs of both the role and the SAML provider.

Step-by-Step Solution

1
Identify the authentication action required for federated SAML logins.
Determine that the trust policy must use the action 'sts:AssumeRoleWithSAML' instead of 'sts:AssumeRole'.
SAML assertions require the WebSSO/SAML-specific assume role action to process security assertions properly.
2
Verify required SAML attributes in the incoming assertion.
Identify that the IdP must send the 'https://aws.amazon.com/SAML/Attributes/Role' attribute populated with the role ARN and SAML provider ARN.
AWS relies on these attributes within the SAML payload to locate the matching IAM role and establish session variables.
3
Examine the role of the Service Control Policy (SCP) in IAM evaluation.
Confirm that the existing SCP allows 'sts:AssumeRoleWithSAML' but does not replace the requirement for a local trust policy.
SCPs act as authorization filters/boundaries and do not grant access or configuration parameters directly.

Key Concept

SAML 2.0 Federation Trust Policy and Assertion Attributes
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic