A Solutions Architect is configuring federated access to the AWS Management Console for enterprise users using an on-premises SAML 2.0 compliant Identity Provider (IdP). Which of the following configuration steps are required in AWS IAM to successfully establish this trust relationship and allow users to assume their federated roles? (Select TWO.)
- Create a SAML identity provider in AWS IAM by uploading the SAML metadata document retrieved from the on-premises Identity Provider.Cevap
- Create an IAM role with a trust policy that allows the federated users to call the sts:AssumeRoleWithSAML action.Cevap
- CCreate an IAM role with a trust policy that allows the federated users to call the sts:AssumeRole action.
- DDefine a Service Control Policy (SCP) that grants the on-premises Identity Provider permission to write to IAM resources in all accounts.
Cevap
The correct configuration steps are creating a SAML identity provider using the metadata document from the corporate Identity Provider and creating an IAM role with a trust policy that allows the sts:AssumeRoleWithSAML action.
Establishing SAML 2.0 federation requires registering the Identity Provider (IdP) as an IAM SAML provider using its metadata document and associating it with an IAM role that explicitly allows the sts:AssumeRoleWithSAML API action in its trust policy.
Adım Adım Çözüm
Anahtar Kavram
SAML 2.0 Identity Federation requires registering the IdP in IAM and configuring federated roles with a trust policy that permits the sts:AssumeRoleWithSAML action.