Examkin

Question

Difficulty: MediumMulti-Account Identity and Access Management Federation

An enterprise is implementing a federated identity solution using an external SAML 2.0 compliant identity provider (IdP) to grant database administrators single sign-on access to Amazon RDS databases across multiple member accounts in AWS Organizations. The solutions architect has configured the SAML identity provider entity in each AWS account. However, during initial testing, users attempting to federate from the IdP dashboard receive an access denied error before they can choose a role. Which configuration step must the solutions architect perform to resolve this authentication error?

  1. Configure the trust policy of the IAM role in each target account to trust the SAML identity provider principal and allow the sts:AssumeRoleWithSAML action, and ensure the IdP is configured to send the required SAML attributes.Answer
  2. B
    Modify the trust policy of the IAM role in each target account to trust the external IdP domain and allow the sts:AssumeRole action, and map the user groups to target role ARNs directly inside the IAM console.
  3. C
    Deploy a Service Control Policy (SCP) at the root of the AWS Organization that permits the sts:AssumeRoleWithSAML action for all member accounts, and remove trust policies from the local IAM roles to simplify configuration.
  4. D
    Configure the external IdP to call the sts:AssumeRoleWithWebIdentity API, and register the IdP as an OpenID Connect (OIDC) provider in each of the member accounts.

Answer

Configure the trust policy of the IAM role in each target account to trust the SAML identity provider principal and allow the sts:AssumeRoleWithSAML action, and ensure the IdP is configured to send the required SAML attributes.
The correct answer correctly specifies the configuration requirements for SAML 2.0 federation in AWS. A successful SAML assertion authentication relies on a trust relationship defined in the IAM role that trusts the SAML provider principal and allows the 'sts:AssumeRoleWithSAML' action. Additionally, the IdP must be configured to pass the mandatory SAML attributes ('Role' and 'RoleSessionName') so AWS can map the user session to the appropriate IAM role.

Step-by-Step Solution

1
Analyze the authentication protocol and federation requirements.
The identity provider uses SAML 2.0, requiring the SAML assertion to match AWS IAM SAML requirements.
Identifying the federation protocol ensures selection of the correct AWS Security Token Service (STS) action and trust principal.
2
Configure the trust policy of the target IAM role.
The trust policy is updated to set the SAML provider ARN as the Principal and permit the 'sts:AssumeRoleWithSAML' action.
This establishes the cryptographic trust relationship between the AWS account and the external SAML IdP.
3
Verify and configure SAML attributes in the IdP.
The IdP is configured to send 'https://aws.amazon.com/SAML/Attributes/Role' and 'https://aws.amazon.com/SAML/Attributes/RoleSessionName' in the assertion.
AWS STS requires these specific claims to determine which IAM role the user is authorized to assume and to identify the session.

Key Concept

SAML 2.0 Federation Trust Configuration
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic