An enterprise manages a multi-account environment using AWS Organizations. The security team is configuring federated single sign-on (SSO) to target AWS accounts using an external, SAML 2.0-compliant corporate Identity Provider (IdP). The team has created a SAML provider entity named 'CorporateIdP' in the target member accounts. In the target member accounts, they also created an IAM role named 'ReadOnlyAuditor' to be assumed by the federated users. However, during the initial testing phase, users receive access denied errors immediately after authentication at the IdP portal when redirecting to the AWS console. The security team verifies that the corporate IdP is successfully generating SAML assertions containing the user's attributes. Which of the following configurations represents the correct setup to resolve this issue and establish federated access?
- Configure the IAM role's trust policy in each target account to allow the action sts:AssumeRoleWithSAML for the Federated principal referencing the ARN of the 'CorporateIdP' provider. Ensure the SAML assertion includes attributes for https://aws.amazon.com/SAML/Attributes/Role (containing the comma-separated role ARN and SAML provider ARN) and https://aws.amazon.com/SAML/Attributes/RoleSessionName.Cevap
- BConfigure the IAM role's trust policy in each target account to allow the action sts:AssumeRole for the Federated principal referencing the 'CorporateIdP' provider. Ensure the SAML assertion includes the user's corporate email mapped to the standard SAML Subject NameID.
- CAttach a Service Control Policy (SCP) at the root level of the AWS Organization that explicitly grants sts:AssumeRoleWithSAML permissions to the SAML provider principal across all member accounts. In each target member account, configure the IAM role trust policy to allow sts:AssumeRole for the AWS Organizations root principal.
- DConfigure the IAM role's trust policy in the target member accounts to trust the corporate Identity Provider using the sts:AssumeRoleWithWebIdentity action. Ensure that the SAML assertion is modified to pass the OAuth 2.0 access token as the primary federated attribute.