An online gaming platform is designing a federated access solution for its developers to access resources across multiple member accounts in an AWS Organization. The company has decided to use an external SAML 2.0 compliant identity provider (IdP) to authenticate developers and allow them to assume the role named DeveloperAccess in the target accounts. Which of the following configuration steps must the solutions architect perform to establish this SAML 2.0 federation and enable federated access? (Select TWO.)
- Create a SAML identity provider entity in each target AWS account using the metadata document retrieved from the external identity provider.Cevap
- Configure a trust policy on the target IAM roles in each member account that permits the sts:AssumeRoleWithSAML action and references the SAML provider ARN as the principal.Cevap
- CCreate a Service Control Policy (SCP) at the AWS Organizations root level to grant sts:AssumeRoleWithSAML permission to all member accounts.
- DConfigure the external identity provider to set the SAML Audience attribute to the IAM role ARN and the SAML Subject to the sts:AssumeRole action.
- EConfigure the trust policy of the target IAM roles to specify the AWS Organizations management account root ARN as the trusted Principal.
Cevap
The correct actions are creating a SAML identity provider in each target account using the external IdP metadata and configuring a trust policy on the target role with the sts:AssumeRoleWithSAML action.
Establishing federation requires registering the external SAML identity provider in the target accounts and configuring target roles with a trust policy that allows sts:AssumeRoleWithSAML from that provider. This enables users authenticated by the external IdP to assume the DeveloperAccess role directly in the member accounts.
Adım Adım Çözüm
Anahtar Kavram
Multi-Account SAML 2.0 Federation