Examkin

Soru

Zorluk: ZorMulti-Account Identity and Access Management Federation

An organization is establishing federated identity access across its multi-account AWS environment using an on-premises PingFederate Identity Provider (IdP). The Solutions Architect needs to set up a configuration that allows external partners to authenticate via the IdP and assume a specific role called PartnerDeveloperRole in target AWS accounts. The configuration must support a maximum session duration of 12 hours for the federated sessions.

Which of the following actions must the Solutions Architect perform to successfully configure this federation? (Select TWO.)

  1. Create an Identity Provider (IdP) of type SAML in each target AWS account using the metadata document from PingFederate, and configure the PartnerDeveloperRole trust policy to allow the sts:AssumeRoleWithSAML action.Cevap
  2. Set the Maximum Session Duration setting of the PartnerDeveloperRole in each target AWS account to 12 hours, and ensure the PingFederate IdP sends the https://aws.amazon.com/SAML/Attributes/SessionDuration attribute in the SAML assertion.Cevap
  3. C
    Configure the PartnerDeveloperRole trust policy in each target account to allow the sts:AssumeRole action for the PingFederate SAML provider ARN as the principal.
  4. D
    Attach a Service Control Policy (SCP) at the root level of AWS Organizations that allows sts:AssumeRoleWithSAML and automatically provisions the PartnerDeveloperRole in all target AWS accounts.

Cevap

To establish SAML-based federation, you must create a SAML Identity Provider in each target account, allow the sts:AssumeRoleWithSAML action in the role's trust policy, configure the role's Maximum Session Duration to 12 hours, and pass the SessionDuration attribute in the SAML assertion from PingFederate.
To successfully set up SAML federation, a SAML identity provider must exist in each AWS target account, and the target role's trust policy must allow the sts:AssumeRoleWithSAML action. To override the default 1-hour session duration limit up to 12 hours, both the Maximum Session Duration parameter on the IAM role must be updated, and the SessionDuration attribute must be supplied within the SAML assertion from PingFederate.

Adım Adım Çözüm

1
Configure SAML Providers and Trust Policies
SAML IdP entities are registered in each target AWS account, and the PartnerDeveloperRole trust policy is set to allow sts:AssumeRoleWithSAML from these provider principals.
AWS STS requires sts:AssumeRoleWithSAML to exchange SAML tokens for temporary credentials.
2
Increase Maximum Session Duration
The Maximum Session Duration on the PartnerDeveloperRole in all target AWS accounts is configured to 12 hours.
The default session duration is 1 hour; this must be explicitly increased to support the 12-hour requirement.
3
Configure SAML Attributes in PingFederate
PingFederate is configured to release the SessionDuration attribute, Role, and RoleSessionName attributes in the SAML assertion.
AWS requires these attributes to map the federated user to the correct IAM role and determine the session duration.

Anahtar Kavram

Establishing multi-account SAML federation and session management
Bu soruyu puanla

Konular

Multi-Account Identity and Access Management Federation

Bu konudan daha fazla soru