Examkin

Question

Difficulty: MediumMulti-Account Identity and Access Management Federation

A retail company is migrating to a multi-account AWS environment managed by AWS Organizations. The company wants to federate its on-premises Active Directory using a SAML 2.0 compliant Identity Provider (IdP) to allow administrators to access the AWS Management Console. The administrators must be able to assume a target role named SysAdminRole in various member accounts. Which of the following actions must the solutions architect take to configure the trust relationship for the federated role?

  1. Create an IAM SAML provider in each target member account, and configure the trust policy of the SysAdminRole to allow the sts:AssumeRoleWithSAML action with the SAML provider as the principal.Answer
  2. B
    Create an IAM SAML provider in the management account only, and configure the trust policy of the SysAdminRole in the target member accounts to allow the sts:AssumeRole action with the management account ID as the principal.
  3. C
    Attach a Service Control Policy (SCP) to the target Organizational Unit (OU) that allows the sts:AssumeRoleWithSAML action, which automatically provisions the federated role and configures the trust relationship in all member accounts.
  4. D
    Configure the SAML provider in a shared services account, and update the default AWS-managed KMS key policies in the member accounts to trust the shared SAML provider for decrypting user assertions.

Answer

Create an IAM SAML provider in each target member account, and configure the trust policy of the SysAdminRole to allow the sts:AssumeRoleWithSAML action with the SAML provider as the principal.
To set up SAML 2.0-based federation to multiple member accounts, an IAM SAML provider must be created in each target account. The target IAM role in those accounts must contain a trust policy that allows the `sts:AssumeRoleWithSAML` action, targeting the local SAML provider as the trusted principal. This enables the Identity Provider to redirect users with a signed SAML assertion that AWS STS can verify to generate temporary console access credentials.

Step-by-Step Solution

1
Download the SAML metadata document from the on-premises Identity Provider (IdP).
Obtained the XML metadata document required to establish trust.
This document contains the signing certificates and endpoints used by the IdP.
2
Create an IAM SAML identity provider in each target AWS member account using the IdP metadata document.
An IAM SAML provider resource is established in each target account.
Each member account must have a local configuration of the trusted IdP to resolve the federation request.
3
Create the SysAdminRole in each target member account with a trust policy that permits the sts:AssumeRoleWithSAML action, referencing the IAM SAML provider ARN as the principal.
The federated role is configured with the correct trust relationships.
This allows AWS Security Token Service (STS) to authenticate SAML assertions and issue temporary credentials to users.

Key Concept

SAML 2.0 Federation in Multi-Account Architectures
Estimated Time:2m 0s
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic