A healthcare provider runs its research workloads in a multi-account environment managed under AWS Organizations. The provider wants to grant access to clinical research data stored in Amazon S3 buckets inside a specific member account. The researchers must authenticate using their existing credentials from an external corporate SAML 2.0-compliant Identity Provider (IdP). The solutions architect creates a SAML provider entity in the member account. However, when researchers attempt to log in and assume the designated research role, the authentication flow fails during the AWS Security Token Service (STS) call. Which configuration change is required in the member account to resolve this federation failure?
- AUpdate the IAM role trust policy in the member account to specify the SAML identity provider as the Principal and permit the sts:AssumeRole action.
- BAttach a Service Control Policy (SCP) to the member account's Organizational Unit (OU) that permits the sts:AssumeRoleWithSAML action for the external identity provider.
- Update the IAM role trust policy in the member account to specify the SAML identity provider as the Principal and permit the sts:AssumeRoleWithSAML action.Cevap
- DRegister the SAML identity provider in the organization's management account and use AWS Resource Access Manager (RAM) to share it with the member account.
Cevap
Update the IAM role trust policy in the member account to specify the SAML identity provider as the Principal and permit the sts:AssumeRoleWithSAML action.
To establish federation with an external SAML 2.0 Identity Provider (IdP), the IAM role's trust policy in the target member account must explicitly specify the SAML provider's ARN as the federated principal and allow the sts:AssumeRoleWithSAML action. This trust relationship allows AWS Security Token Service (STS) to validate the SAML assertion and issue temporary security credentials.
Adım Adım Çözüm
Anahtar Kavram
SAML 2.0 Identity Federation Trust Policies
Tahmini Süre:1m 30s