Soru

Zorluk: KolayMulti-Account Identity and Access Management Federation

A Solutions Architect is configuring federated access to the AWS Management Console for enterprise users using an on-premises SAML 2.0 compliant Identity Provider (IdP). Which of the following configuration steps are required in AWS IAM to successfully establish this trust relationship and allow users to assume their federated roles? (Select TWO.)

  1. Create a SAML identity provider in AWS IAM by uploading the SAML metadata document retrieved from the on-premises Identity Provider.Cevap
  2. Create an IAM role with a trust policy that allows the federated users to call the sts:AssumeRoleWithSAML action.Cevap
  3. C
    Create an IAM role with a trust policy that allows the federated users to call the sts:AssumeRole action.
  4. D
    Define a Service Control Policy (SCP) that grants the on-premises Identity Provider permission to write to IAM resources in all accounts.

Cevap

The correct configuration steps are creating a SAML identity provider using the metadata document from the corporate Identity Provider and creating an IAM role with a trust policy that allows the sts:AssumeRoleWithSAML action.
Establishing SAML 2.0 federation requires registering the Identity Provider (IdP) as an IAM SAML provider using its metadata document and associating it with an IAM role that explicitly allows the sts:AssumeRoleWithSAML API action in its trust policy.

Adım Adım Çözüm

1
Register the external identity provider in AWS IAM.
AWS IAM creates a SAML 2.0 identity provider using the metadata document from the on-premises IdP.
This establishes a cryptographically verified trust relationship between the corporate IdP and the AWS account.
2
Configure the federated IAM role and its trust policy.
An IAM role is created with a trust policy that allows the SAML provider to assume the role using the sts:AssumeRoleWithSAML action.
When users authenticate through the IdP, the IdP sends a SAML assertion to AWS. The trust policy allows AWS to grant temporary security credentials based on that assertion.

Anahtar Kavram

SAML 2.0 Identity Federation requires registering the IdP in IAM and configuring federated roles with a trust policy that permits the sts:AssumeRoleWithSAML action.
Bu soruyu puanla